WLB 2016030131

cxsecurity.com • October 21, 2026

# Exploit Title: Wordpress Plugin Issuu Panel - RFI & LFI # Exploit Author: CrashBandicot # Date: 2016-03-23 # Google Dork : inurl:/wp-content/plugins/issuu-panel/ # Vendor Homepage: # Tested on: MsWIn # Version: 1.6 # Vulnerable File : /documento/requests/ajax-docs.php 3. require($_GET['abspath'] . '/wp-load.php'); # PoC :

Thanks for you ! Your message is in quarantine 48 hours.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

WordPress Issuu Panel Plugin Vulnerability Exposes Sites to RFI and LFI Attacks A vulnerability in the Issuu Panel WordPress plugin (version 1.6.6) allows for Remote File Inclusion (RFI) and Local File Inclusion (LFI) attacks via the ajax-docs.php file. This flaw, identified as CWE-98, could enable attackers to execute arbitrary PHP code on affected sites. The vulnerability affects WordPress installations using the Issuu Panel plugin, which is widely used for document management. A proof-of-concept (PoC) exploit has been published, raising concerns about potential exploitation in the wild. Users are advised to prioritize patching this vulnerability to mitigate risks. The vulnerability was disclosed on October 21, 2026, and is listed under WLB-2016030131. No specific patches were mentioned in the articles, indicating a need for immediate action from site administrators. 52

Extracted Entities

WLB 2016030131

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)