{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/memphis-documents-library--3.1.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:memphis_documents_library_project:memphis_documents_library:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2016-20100"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Memphis Documents Library (\u003c 3.1.6)"],"_cs_severities":["high"],"_cs_tags":["wordpress","vulnerability","web-application","path-traversal"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eThe Memphis Documents Library plugin for WordPress, in versions prior to 3.1.6, contains a path traversal vulnerability. This flaw exists within the mdocs_img_preview() function in the file mdocs-downloads.php. Unauthenticated remote attackers can leverage this vulnerability by injecting path traversal sequences into the mdocs-img-preview URL parameter. By successfully manipulating this input, attackers can access and read arbitrary files located on the web server. This vulnerability is highly critical as it permits the exfiltration of sensitive configuration files, such as wp-config.php, which often contains database credentials and other environment secrets. The Shadowserver Foundation reported observing in-the-wild exploitation of this vulnerability starting in October 2023, making patching a high priority for WordPress administrators utilizing this specific plugin.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify websites utilizing the Memphis Documents Library plugin.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP GET request targeting the mdocs_img_preview() function within mdocs-downloads.php.\u003c/li\u003e\n\u003cli\u003eAttacker injects path traversal sequences (e.g., ../../) into the mdocs-img-preview parameter.\u003c/li\u003e\n\u003cli\u003eThe plugin fails to adequately sanitize the user-supplied input, allowing the directory traversal.\u003c/li\u003e\n\u003cli\u003eThe server processes the request and retrieves the contents of the requested file outside the web root.\u003c/li\u003e\n\u003cli\u003eThe sensitive file content, such as the site configuration, is returned in the HTTP response body to the attacker.\u003c/li\u003e\n\u003cli\u003eAttacker parses the exfiltrated configuration file to extract database credentials.\u003c/li\u003e\n\u003cli\u003eAttacker uses stolen credentials to access or modify the site database.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read any file on the underlying server that the web server user has read access to. The primary risk is the theft of the wp-config.php file, leading to the compromise of database credentials and potentially full administrative access to the WordPress application or the underlying hosting environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Memphis Documents Library plugin to version 3.1.6 or later immediately to resolve the vulnerability.\u003c/li\u003e\n\u003cli\u003eAudit web server access logs for requests containing suspicious path traversal patterns (e.g., ../) targeting the mdocs-img-preview parameter.\u003c/li\u003e\n\u003cli\u003eReview database access logs and application logs for unusual activity following the potential exposure of wp-config.php.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T21:53:43Z","date_published":"2026-10-20T21:53:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-memphis-docs-path-traversal/","summary":"The Memphis Documents Library plugin for WordPress is vulnerable to path traversal via the mdocs-img-preview parameter, allowing unauthenticated attackers to read arbitrary files.","title":"Memphis Documents Library: Path traversal vulnerability (CVE-2016-20100)","url":"https://feed.craftedsignal.io/briefs/2026-10-memphis-docs-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Memphis Documents Library (\u003c 3.1.6)","version":"https://jsonfeed.org/version/1.1"}