Attack Chain

1. Attacker performs reconnaissance to identify WordPress installations running the Issuu Panel plugin.
2. Attacker crafts a malicious GET request targeting the vulnerable file '/menu/documento/requests/ajax-docs.php'.
3. Attacker injects a malicious file path or remote URL into the 'abspath' parameter of the HTTP request.
4. The web server process receives the request and processes the PHP file 'ajax-docs.php'.
5. The vulnerable code within the plugin passes the attacker-supplied 'abspath' value directly to the 'require()' function.
6. The PHP interpreter executes the code located at the malicious URL or includes the local file specified by the attacker.
7. Attacker gains Remote Code Execution (RCE) on the underlying web server or exfiltrates sensitive server-side files.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code with the privileges of the web server user (e.g., www-data) or read sensitive configuration files (e.g., wp-config.php), leading to full site compromise, data exfiltration, and potential lateral movement within the hosting environment.

Recommendation

• Update the Issuu Panel plugin for WordPress to version 1.6.6 or later immediately to patch CVE-2016-20101.
• Monitor web server access logs for anomalous GET requests containing suspicious 'abspath' parameters targeting 'ajax-docs.php'.
• Deploy the provided Sigma rule to detect attempts to exploit this file inclusion vulnerability via the web application layer.