CVE-2016-20078: WordPress IMDb Profile Widget Local File Inclusion Vulnerability

Technical summary

CVE-2016-20078 is a local file inclusion (LFI) vulnerability in the WordPress IMDb Profile Widget plugin version 1.0.8. The vulnerability exists in the `pic.php` endpoint, which fails to properly validate or sanitize the `url` GET parameter before using it in file operations. An unauthenticated attacker can supply directory traversal sequences (e.g., `../../wp-config.php`) to bypass path restrictions and read arbitrary files accessible to the web server process. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which encompasses path traversal and file inclusion issues. The CVSS 3.1 score of 6.2 (Medium severity) reflects high confidentiality impact with local attack vector scope and low attack complexity.

Business impact

Successful exploitation enables attackers to extract sensitive configuration files and credentials without any authentication. The most critical exposure is the `wp-config.php` file, which typically contains database credentials, encryption keys, and API tokens. Compromise of these credentials can lead to unauthorized database access, lateral movement within infrastructure, and potential privilege escalation. For WordPress sites using this plugin, this vulnerability represents a direct pathway to configuration disclosure that could facilitate follow-on attacks such as database manipulation, user account compromise, or site defacement. Organizations running affected versions face immediate risk of credential theft and operational data exposure.

Affected systems

WordPress installations using the IMDb Profile Widget plugin version 1.0.8 are directly affected. The plugin must be installed and activated for the vulnerability to be exploitable. Since the flaw is in the unauthenticated `pic.php` endpoint, any WordPress site with this exact plugin version exposed to untrusted network traffic is at risk. Verify your WordPress plugins list and check for IMDb Profile Widget installations; if present, immediately determine the installed version.

Exploitability

This vulnerability has a low barrier to exploitation. The attack requires only HTTP GET requests with specially crafted parameters—no authentication, complex bypasses, or specialized tools are necessary. An attacker need only modify the `url` parameter in requests to `pic.php` to include directory traversal sequences and attempt to read files. The attack surface is wide: any unauthenticated user on the internet can probe affected sites. However, successful file reading depends on the web server process having read permissions on target files and those files being within accessible directory scope. The flaw is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but the simplicity of exploitation means public awareness and tooling could emerge rapidly if not already present.

Remediation

Immediately disable or deactivate the IMDb Profile Widget plugin on all affected WordPress installations. If the plugin is essential to your site's functionality, contact the plugin vendor for a patched version or consider migrating to an alternative maintained IMDb integration plugin. As an interim control, restrict HTTP access to `pic.php` at the web server level using firewall rules or `.htaccess` configuration if available. After plugin removal, scan `wp-config.php` and database logs for signs of unauthorized access or suspicious queries. If database credentials were potentially exposed, rotate the database password and review user accounts and permissions.

Patch guidance

No official patch version for version 1.0.8 has been identified in the provided vendor data. Check the official WordPress plugin repository for the IMDb Profile Widget to determine if an updated version is available. If no patch exists, the plugin is likely abandoned or unmaintained—deactivation and removal is the recommended course of action. Before updating, back up your WordPress database and `wp-config.php`. If a newer version is available, test it in a staging environment before deploying to production.

Detection guidance

Monitor web server access logs for HTTP GET requests to `pic.php` containing suspicious patterns, particularly those with directory traversal sequences (`../`, `..\`, URL-encoded variants like `%2e%2e%2f`), or attempts to access known sensitive files (`wp-config.php`, `.env`, `config.php`). Implement Web Application Firewall (WAF) rules to block requests containing directory traversal payloads. Enable WordPress security plugins that monitor for plugin vulnerabilities and file access anomalies. Conduct a file integrity check on `wp-config.php` and other configuration files to detect unauthorized reads or modifications. Review database access logs for unexpected connections or queries that might indicate credential compromise.

Why prioritize this

Although classified as Medium severity, this vulnerability should receive high prioritization due to the combination of unauthenticated access, high confidentiality impact, and direct exposure of database credentials. The attack surface is broad (any internet-facing WordPress site with the plugin), and exploitation is trivial. Credential theft from `wp-config.php` can rapidly escalate to database compromise and site takeover. Immediate action is needed; this is not a vulnerability that can be deferred to routine patch cycles.

Risk score, explained

The CVSS 3.1 score of 6.2 reflects: Attack Vector = Local (AV:L), meaning the attacker must have local or adjacent network access rather than remote internet access; however, in the context of a web-accessible endpoint, this is effectively network-level access for a WordPress site. Attack Complexity = Low (AC:L), meaning no special conditions are required beyond crafting a malicious request. Privileges Required = None (PR:N), confirming unauthenticated exploitation. User Interaction = None (UI:N), requiring no social engineering or user action. Confidentiality Impact = High (C:H), as arbitrary files can be read. Integrity and Availability impacts are None (I:N, A:N). The 6.2 score, while labeled Medium, understates the practical risk because credential exposure can enable high-impact follow-on attacks. Treat this as high-urgency despite the Medium CVSS rating.

Frequently asked questions