Read the docs
TI-2016-09373 Aliases CVE-2016-20101GHSA-788p-94rp-c28h

PHP file inclusion in Issuu Panel WordPress plugin lets attackers run code

Priority HIGH 75CWE-98Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-98.

Summary

The Issuu Panel plugin for WordPress from 1.0 before 1.6.6 contains a PHP file inclusion flaw (CWE-98) in which the abspath parameter is passed to require(). An unauthenticated remote attacker can send GET requests to menu/documento/requests/ajax-docs.php to include remote or local files and run remote PHP code. A public exploit is linked in the references, and Shadowserver first observed exploitation on 2023-10-20.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00398 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Issuu Panel (Pedro Marcelo): 1.6.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Pedro MarceloIssuu Panel1.0 to before 1.6.61.6.6Patch availableCNA
  • Issuu Panel VendorPedro Marcelo Affected 1.0 to before 1.6.6 Fixed in 1.6.6 Patch available CNA

Remediation

Update Issuu Panel to version 1.6.6 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Issuu Panel (Pedro Marcelo) Fixed in 1.6.6

Timeline

  1. 2026-10-20 Threatist record created from CVE-2016-20101
  2. 2026-10-21 Alias added: GHSA-788p-94rp-c28h
  3. 2026-10-27 CISA SSVC decision points changed
  4. 2026-10-27 Priority changed: MEDIUM → HIGH

References

Exploit 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences