External risk intelligence

WordPress Issuu Panel Plugin PHP File Inclusion

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2016-20101

The vulnerability exists in a WordPress plugin. WordPress sites are commonly deployed as public-facing web applications, and this plugin adds functionality that is typically accessible via the web server's public-facing interface, making it reachable by internet-based attackers.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a vulnerability in a WordPress plugin that could allow unauthenticated attackers to access or execute files on affected systems. The issue stems from a PHP file inclusion flaw that can be triggered through specific requests.

Plugin flaw lets attackers include files.
Impacts systems using the Issuu Panel plugin.
Confirm relevance and exposure to the plugin.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a crafted GET request to the `ajax-docs.php` file within the Issuu Panel plugin. This request would include a manipulated `abspath` parameter, which the plugin improperly uses with the `require()` function. Successful manipulation allows the attacker to include arbitrary local files or execute remote PHP code on the server.

Requires unauthenticated network access.
Triggered via crafted GET request to `ajax-docs.php`.
Allows remote code execution or local file inclusion.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to include local or remote files on a WordPress site, potentially leading to the execution of arbitrary PHP code when supported by the advisory's conditions.

System files and sensitive information.
Via crafted GET requests to a plugin's AJAX endpoint.
Arbitrary code execution on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for WordPress instances, including infrastructure and application owners, should address this critical vulnerability. The first practical step is to identify all WordPress sites utilizing the Issuu Panel plugin, confirm their exposure and business criticality, and then prioritize remediation efforts.

Plugin owners must address this issue.
Verify plugin installations and network exposure.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Issuu Panel plugin for WordPress?

Issuu Panel is a plugin designed to integrate Issuu’s digital publishing platform directly into a WordPress site. Users typically install it to embed documents, magazines, or catalogs hosted on Issuu onto their web pages. By simplifying how multimedia content appears, it allows site administrators to display interactive publications without manual coding, effectively acting as a bridge between the WordPress media management system and the Issuu content library.

What does PHP file inclusion mean for CVE-2016-20101?

This vulnerability is classified as Improper Control of Filename for Include/Require Statement, or CWE-98. In plain English, the plugin takes input from a user and uses it to decide which file the server should load. Because the plugin does not properly verify this input, an attacker can trick the server into loading files it shouldn't access—such as local sensitive system files—or even executing malicious PHP code provided from a remote location.

How is this vulnerability triggered by an attacker?

An attacker triggers this by sending a specially crafted GET request to a specific file inside the plugin, ajax-docs.php. By manipulating the 'abspath' parameter in that request, they provide a path to a file they want the server to include. Importantly, this bug requires the plugin to be active and reachable; it does not trigger if the plugin is disabled, deleted, or if the server configuration prevents the execution of arbitrary paths via the require() function.

Why should I care about this vulnerability?

You should care if your organization runs WordPress sites with this plugin. According to Halo Surface Signal, this vulnerability is highly relevant because WordPress sites are almost always internet-facing. Since this plugin adds public-facing functionality, the vulnerable endpoint is likely accessible to anyone on the internet, meaning attackers do not need special access to your internal network to attempt an exploit.

Do I need to update my WordPress site immediately?

Yes, you should prioritize checking your systems. Start by auditing your WordPress installations to identify any active usage of the Issuu Panel plugin. If you find versions older than 1.6.6, confirm their exposure to the internet. The first practical step is to verify the plugin's presence and business impact, then proceed to remove the plugin or update it if a secure version is available to close this critical path for code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.