Skip to content
WordPress Issuu Panel Plugin Vulnerability Exposes Sites to RFI and LFI Attacks

WordPress Issuu Panel Plugin Vulnerability Exposes Sites to RFI and LFI Attacks

First seen 21 Oct 2026, 01:17 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 02:20 UTC
  • •The Issuu Panel plugin is vulnerable to RFI and LFI attacks due to improper filename control.
  • •A proof-of-concept exploit has been made public, increasing the risk of exploitation.
  • •Site administrators should prioritize patching to protect against potential attacks.

A vulnerability in the Issuu Panel WordPress plugin (version 1.6.6) allows for Remote File Inclusion (RFI) and Local File Inclusion (LFI) attacks via the ajax-docs.php file. This flaw, identified as CWE-98, could enable attackers to execute arbitrary PHP code on affected sites. The vulnerability affects WordPress installations using the Issuu Panel plugin, which is widely used for document management. A proof-of-concept (PoC) exploit has been published, raising concerns about potential exploitation in the wild. Users are advised to prioritize patching this vulnerability to mitigate risks. The vulnerability was disclosed on October 21, 2026, and is listed under WLB-2016030131. No specific patches were mentioned in the articles, indicating a need for immediate action from site administrators.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
Vulnerability disclosed
The Issuu Panel WordPress plugin vulnerability was publicly disclosed, allowing RFI and LFI attacks.
VulnCheck
2026-10-21
PoC exploit published
A proof-of-concept exploit for the vulnerability was released, demonstrating the potential for exploitation.
CXSecurity

More articles in this cluster (2)

Extracted Entities (6)

1 / 3

Common questions

Which versions of the Issuu Panel plugin are affected?
The vulnerability affects version 1.6.6 of the Issuu Panel WordPress plugin.
Is there a patch available for this vulnerability?
The articles do not mention any specific patches available for the vulnerability at this time.
How can I protect my WordPress site from this vulnerability?
Site administrators should monitor for updates from the plugin vendor and consider disabling the plugin until a patch is available.