WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php
Vulnerability Description
WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the 'id' parameter to the decode.php endpoint to retrieve sensitive files like wp-config.php containing database credentials and configuration data.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-20077
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- CrashBandicot @DosPerl
Affected Vendor
KaymeePhotography
View all reports →