CVE-2016-20064: WP Vault 0.8.6.6 Arbitrary File Read via Directory Traversal

Technical summary

The vulnerability exists in WP Vault 0.8.6.6's include functionality, which fails to properly sanitize or escape the wpv-image parameter before passing it to file inclusion operations. This is a classic arbitrary file read vulnerability classified as Improper Input Validation (CWE-98). An unauthenticated remote attacker can supply path traversal sequences via the GET parameter to break out of intended directory boundaries and access files anywhere on the web server's filesystem. The vulnerability affects the confidentiality of stored data but does not enable code execution, data modification, or service disruption based on the attack vector alone.

Business impact

This vulnerability exposes your organization to unauthorized disclosure of sensitive information stored on servers running WP Vault. Attackers could extract database configuration files, authentication credentials, private keys, API tokens, customer data, and other confidential information without any legitimate access. Such disclosures can lead to regulatory compliance violations (GDPR, HIPAA, PCI DSS depending on data types exposed), reputational damage, secondary compromises leveraging stolen credentials, and potential legal liability. The attack requires no authentication and can be automated at scale, making this a persistent exposure if left unpatched.

Affected systems

Any deployment of WP Vault version 0.8.6.6 is vulnerable. Organizations running this plugin should immediately inventory affected installations. The vulnerability does not appear in the vendor_products field data available, so verify your specific deployment version and configuration. If your installation has been updated beyond 0.8.6.6, confirm the update version number against the vendor's advisory to ensure the LFI has been remediated.

Exploitability

This vulnerability has a CVSS v3.1 score of 6.2 (MEDIUM) with a local attack vector (AV:L), reflecting that the attacker must have some level of local network or filesystem access context. However, the lack of privilege requirements (PR:N) and user interaction (UI:N) means any unauthenticated user on the network segment can attempt exploitation. The attack is trivial to execute—simply crafting a malicious URL with directory traversal sequences in the wpv-image parameter. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, but the simplicity of exploitation and the high value of the exposed information suggest this could attract attacker attention once publicly disclosed.

Remediation

Immediately upgrade WP Vault to a patched version released after June 2026. Contact the plugin vendor for the specific version number and patch release notes. If an immediate patch is unavailable, consider disabling or removing WP Vault from production environments until a fix is confirmed. Review server access logs for evidence of exploitation attempts using patterns like '../' in the wpv-image parameter. Conduct a forensic review of potentially exposed files to determine if credential compromise has occurred and rotate any exposed secrets.

Patch guidance

Apply the vendor's patched version of WP Vault as soon as it becomes available. The vendor advisory will specify the minimum version required to resolve CWE-98 (Improper Input Validation). Verify in your change control system that the update has been deployed to all affected instances. Test the patch in a staging environment first to ensure no compatibility issues with your WordPress configuration. Once deployed, confirm that the wpv-image parameter is now properly escaped and that directory traversal sequences are rejected or safely neutralized.

Detection guidance

Monitor web server access logs for GET requests containing the wpv-image parameter paired with path traversal sequences such as '../', '..\\', or URL-encoded variants (%2e%2e%2f). Implement WAF rules to block requests to WP Vault endpoints that include traversal patterns. Conduct file integrity monitoring on sensitive files (config files, credential stores) to detect unauthorized read access. Review WordPress plugin audit logs if available. Search for indicators of compromise: unusual file access patterns in server logs, evidence of configuration file exfiltration, and signs of credential reuse from exposed secrets. Correlate timestamps with any known vulnerability disclosure dates.

Why prioritize this

Although the CVSS score is MEDIUM (6.2), this vulnerability warrants high prioritization because it enables unauthenticated, effortless information disclosure with no exploitation complexity. The attack surface is the entire unauthenticated internet if your WP Vault instance is accessible remotely. The impact—exposure of configuration, credentials, and customer data—directly threatens compliance, incident response capability, and downstream security. Organizations using WP Vault should treat this as a critical operational priority for patching and forensic review, regardless of the numeric CVSS score.

Risk score, explained

The CVSS v3.1 score of 6.2 reflects a MEDIUM severity rating based on a local attack vector and no impact to integrity or availability. However, this score may underrepresent real-world risk in environments where the affected server is internet-facing and accessible without VPN or IP restrictions. The 'L' in Attack Vector accounts for the assumption that an attacker must be on the local network segment, but in many cloud and hybrid environments, the effective attack vector is network-adjacent or network-accessible. Organizations should apply contextual risk scoring: if WP Vault is publicly accessible over the internet, escalate this to HIGH priority; if it is behind a firewall and accessible only to trusted users, the MEDIUM score is more representative.

Frequently asked questions