CVE-2016-20077: WordPress Photocart Link Plugin Local File Inclusion Vulnerability

Technical summary

CVE-2016-20077 is a local file inclusion (LFI) vulnerability stemming from insufficient input validation in the Photocart Link WordPress plugin (version 1.6). The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The decode.php endpoint accepts user-supplied input via the 'id' parameter without adequate sanitization or access controls. When an attacker base64-encodes a file path and passes it as the 'id' value, the plugin decodes and includes the specified file, enabling arbitrary file read operations. This permits unauthenticated access to sensitive files including wp-config.php, which stores database credentials and configuration secrets.

Business impact

A successful exploit could expose critical infrastructure secrets, including database credentials and authentication keys, potentially leading to full database compromise, website defacement, or lateral movement into backend systems. Organizations running vulnerable versions of Photocart Link on publicly accessible WordPress sites face immediate risk of credential theft and data exfiltration. The exposure of wp-config.php is particularly severe as it typically contains plaintext or minimally protected secrets needed for complete site takeover.

Affected systems

WordPress websites using Photocart Link plugin version 1.6 are directly affected. The vulnerability requires no authentication and can be exploited remotely by any unauthenticated user who can reach the plugin's decode.php endpoint. The impact scope is local to the server filesystem; however, the nature of the accessible files means sensitive data can be read and exfiltrated to external systems.

Exploitability

This vulnerability presents moderate exploitability due to low attack complexity and minimal barriers to weaponization. No user interaction is required, attackers need no privileges, and the endpoint is accessible unauthenticated. The primary constraint is local attack vector context—the attacker must be able to request the plugin endpoint—but this is typically achievable remotely on internet-facing WordPress sites. Base64-encoding file paths is a straightforward technique, making reliable attack code simple to develop.

Remediation

Organizations should immediately disable or remove the Photocart Link plugin version 1.6 from all WordPress installations. Check vendor advisory and security notices for patched versions; if a security update is available, apply it after testing in a staging environment. If the plugin is still in use, implement access restrictions via .htaccess or Web Application Firewall (WAF) rules to block requests to decode.php pending patch availability. Conduct a file integrity review and audit logs to detect prior exploitation attempts or unauthorized file access.

Patch guidance

Verify the plugin vendor's advisory for available patched versions. Apply any security updates released after version 1.6. Until a patch is confirmed available and tested, the safest approach is to deactivate and remove the plugin entirely if no longer needed. If the plugin is business-critical, isolate it behind authentication or WAF rules and plan an urgent migration to an alternative, maintained solution.

Detection guidance

Monitor web server logs for requests to decode.php, particularly those containing base64-encoded strings or suspicious characters in the 'id' parameter. Implement WAF rules to detect and block requests to /decode.php endpoints or patterns matching base64-encoded file paths. Check file access logs for unexpected reads of wp-config.php and other sensitive configuration files. Endpoint Detection and Response (EDR) solutions should flag processes spawning from the web server that read wp-config.php or other credential stores outside normal operation.

Why prioritize this

Although the CVSS score is 6.2 (MEDIUM), the practical severity is high due to the trivial exploitability of the vulnerability and the extreme sensitivity of exposed data (database credentials). The plugin appears to be unmaintained or rarely patched given the CVE publication date, increasing likelihood that vulnerable instances remain in production. Exposure of wp-config.php credentials typically leads to rapid follow-on compromise. Organizations running this plugin should treat it as high-priority for removal or patching.

Risk score, explained

The CVSS 3.1 score of 6.2 reflects a MEDIUM severity rating based on high confidentiality impact (C:H), no integrity or availability impact, local attack vector context, low attack complexity, and no privilege or user interaction requirements. The local attack vector designation reflects that the plugin must be reachable by an attacker, not that physical access is required. In practice, internet-facing WordPress sites are readily accessible, making this vulnerability highly exploitable despite the MEDIUM CVSS label.

Frequently asked questions