CVE-2016-20082: Abtest WordPress Plugin Local File Inclusion Vulnerability

Technical summary

CVE-2016-20082 is a local file inclusion (LFI) vulnerability in the Abtest WordPress plugin. The vulnerability stems from insufficient input validation on the 'action' parameter passed to abtest_admin.php. Unauthenticated attackers can manipulate this parameter via GET requests to include arbitrary files from the admin directory, leading to information disclosure and potential code execution. The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

Business impact

This vulnerability could expose sensitive WordPress configuration files containing database credentials, API keys, and other secrets that attackers could leverage for deeper compromise. If exploited, an attacker could execute arbitrary PHP code within the context of your WordPress installation, potentially leading to data theft, website defacement, or lateral movement to other systems on your network. The lack of authentication requirements means any internet-facing WordPress instance running the vulnerable plugin is at risk without manual mitigation.

Affected systems

WordPress installations with the Abtest plugin installed and active are affected. The vulnerability affects all versions of this plugin that contain the unpatched abtest_admin.php file. Any WordPress site publicly accessible on the internet is a target, regardless of overall security posture. This includes WooCommerce stores, content sites, and corporate WordPress instances.

Exploitability

Exploitation is straightforward and requires no authentication, no special user interaction, and can be performed entirely remotely via HTTP GET requests. An attacker needs only to identify a target running the Abtest plugin and craft a request with a malicious action parameter. No complex technical knowledge or zero-day research is required; this is a basic file inclusion attack pattern that has been automated in numerous tools.

Remediation

Immediately deactivate and remove the Abtest plugin from all affected WordPress installations. Check your plugin repository for any available security updates from the plugin vendor; if no patch is available and the plugin is no longer maintained, permanent removal is the only option. After removal, scan your WordPress installation and database for signs of compromise, particularly reviewing database credentials, user accounts, and file modifications. Verify server logs for suspicious requests to abtest_admin.php.

Patch guidance

Verify the latest version of the Abtest plugin against the vendor's official security advisory to confirm patch availability. If a patched version is available, test it in a staging environment before production deployment. Given the publish date of this advisory, check whether the plugin is still actively maintained by the vendor. If the plugin has been abandoned or deprecated, removal rather than patching is the safest path forward.

Detection guidance

Monitor web server access logs for GET requests to abtest_admin.php files with unusual or suspicious 'action' parameter values, particularly those containing path traversal sequences (../, ..\) or file paths. Intrusion detection systems should flag attempts to access admin files from unauthenticated sessions. File integrity monitoring on WordPress core and plugin directories will detect unauthorized file modifications resulting from code execution. Review plugin activity logs if logging is enabled to identify when the plugin was first installed and when the vulnerability window existed.

Why prioritize this

Although this is classified as MEDIUM severity, its criticality in practice is elevated because it affects unauthenticated remote attackers, has low attack complexity, and can lead to code execution. The confidentiality impact is high (CVSS C:H), exposing sensitive configuration data. Organizations should treat this as a priority remediation despite the medium score, particularly if the plugin is deployed on public-facing sites or handles customer data.

Risk score, explained

CVSS 3.1 score of 6.2 reflects a local attack vector and no direct availability or integrity impact in the score itself. However, the score underrepresents practical risk: the ability to read arbitrary files (high confidentiality impact) combined with local file inclusion patterns that often enable code execution means real-world exploitation can exceed the base score implications. The lack of authentication requirement and low attack complexity are critical aggravating factors.

Frequently asked questions