CVE-2016-20079: WordPress Dharma Booking Local File Inclusion Vulnerability

Technical summary

CVE-2016-20079 is a local file inclusion (LFI) vulnerability in the Dharma Booking WordPress plugin affecting version 2.28.3 and earlier. The vulnerability exists in proccess.php where the gateway parameter is insufficiently validated, allowing unauthenticated local attackers to include and read arbitrary files. Exploitation techniques include directory traversal (../) sequences and null byte injection (%00) to circumvent path restrictions. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) categorizes the root cause: inadequate input sanitization combined with dynamic file inclusion operations. The attack vector is local (AV:L) with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N).

Business impact

Exploitation exposes sensitive data including WordPress database credentials, configuration parameters, environment variables, and system file contents. This information disclosure can facilitate secondary attacks such as database compromise, lateral movement, or privilege escalation if exposed data contains system paths, application logic, or authentication tokens. For sites hosting customer data or payment processing, file disclosure may create compliance violations under GDPR, PCI-DSS, or similar frameworks. Attackers with local access to an affected server can systematically enumerate and extract valuable information without triggering obvious alarm conditions.

Affected systems

WordPress installations running the Dharma Booking plugin version 2.28.3 or earlier are affected. The attack vector is local, meaning the attacker must already have some level of local system access or the plugin must be accessible through a web interface with an unauthenticated endpoint that processes the gateway parameter. Organizations should inventory Dharma Booking installations, document active versions, and identify whether plugin endpoints are exposed to untrusted networks.

Exploitability

The vulnerability is moderately exploitable. It requires local access to the affected system, which limits the attack surface compared to remote vulnerabilities. However, once local access is achieved—whether through a compromised account, misconfigured file permissions, or shared hosting environments—exploitation is straightforward: an attacker merely manipulates the gateway parameter with directory traversal sequences to read arbitrary files. No authentication is required. The attack does not require user interaction or any particular system configuration. CVSS 3.1 assigns a score of 6.2 (MEDIUM) reflecting the local access requirement offset by high confidentiality impact.

Remediation

The primary remediation is to upgrade the Dharma Booking plugin to a patched version. Verify the latest security update from the plugin vendor or WordPress.org plugin repository. Until patching is possible, implement the following interim controls: restrict local file system access using operating system permissions, disable unnecessary PHP functions (e.g., include, require) if not used elsewhere, implement strict input validation and canonicalization on the gateway parameter to reject directory traversal sequences and null bytes, apply Web Application Firewall (WAF) rules to detect and block directory traversal payloads, and monitor file access logs for suspicious patterns.

Patch guidance

Check the WordPress Dharma Booking plugin repository or vendor advisory for the patched version that addresses CVE-2016-20079. Patches typically introduce strict input validation on the gateway parameter, whitelist allowed file paths, or refactor the code to avoid dynamic file inclusion based on user input. Test the patch in a staging environment before deploying to production to confirm compatibility with your WordPress theme and other plugins. Verify that the update is applied by confirming the installed plugin version and reviewing security notices in the WordPress admin dashboard.

Detection guidance

Monitor for exploitation attempts by searching web server and application logs for requests to proccess.php containing directory traversal sequences (../, ..\ variations) or null bytes (%00) in the gateway parameter. Examine file access logs on the server for unusual reads of sensitive files such as wp-config.php, .env, /etc/passwd (on Linux), or other system configuration files. Implement log aggregation and alerting to flag GET or POST requests to proccess.php with suspicious gateway parameter values. File integrity monitoring on critical configuration files can detect post-exploitation tampering or credential harvesting.

Why prioritize this

While CVE-2016-20079 carries a MEDIUM CVSS score, prioritization depends on your organization's exposure. If you operate WordPress sites with the Dharma Booking plugin version 2.28.3 or earlier and those sites are accessible to users with local system access—or if you run shared hosting environments—this should be addressed promptly. The vulnerability is trivial to exploit once local access exists, making it attractive to insider threats and attackers who have compromised a legitimate user account. However, if you do not use this plugin or have already upgraded, the risk is mitigated. Focus on identifying active installations and applying updates within a standard maintenance window.

Risk score, explained

The CVSS 3.1 score of 6.2 (MEDIUM) reflects a vulnerability with high confidentiality impact (C:H) but no integrity or availability impact. The local attack vector (AV:L) and requirement for local access significantly reduce the overall severity compared to remotely exploitable vulnerabilities. Low attack complexity (AC:L) and no privilege requirement (PR:N) indicate that exploitation is straightforward once the precondition of local access is met. The score accurately represents a data disclosure risk that is serious but constrained by access requirements.

Frequently asked questions