Issuu Panel Wordpress Plugin 1.6.6 File Inclusion Via Ajax Docs Php

Back www.vulncheck.com

Issuu Panel Wordpress Plugin 1.6.6 File Inclusion Via Ajax Docs Php

www.vulncheck.com • October 21, 2026

Share: View original

CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CXSecurity WLB-2016030131

WordPress Download Page

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

WordPress Issuu Panel Plugin Vulnerability Exposes Sites to RFI and LFI Attacks A vulnerability in the Issuu Panel WordPress plugin (version 1.6.6) allows for Remote File Inclusion (RFI) and Local File Inclusion (LFI) attacks via the ajax-docs.php file. This flaw, identified as CWE-98, could enable attackers to execute arbitrary PHP code on affected sites. The vulnerability affects WordPress installations using the Issuu Panel plugin, which is widely used for document management. A proof-of-concept (PoC) exploit has been published, raising concerns about potential exploitation in the wild. Users are advised to prioritize patching this vulnerability to mitigate risks. The vulnerability was disclosed on October 21, 2026, and is listed under WLB-2016030131. No specific patches were mentioned in the articles, indicating a need for immediate action from site administrators. 52

Extracted Entities

Platforms (2)

Vulnerabilities (2)

File Inclusion Via Ajax PHP Remote File Inclusion