CVE-2016-20080

CVE Database · CVE-2016-20080

CVE-2016-20080

· MEDIUMReceived

CVSS v3.1

6.2

CVSS v4.0

6.9

EPSS

0.39%

Published

Jun 15, 2026

Modified

Jun 15, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to include arbitrary files by manipulating the wp_abspath parameter. Attackers can supply path traversal sequences or remote URLs through the wp_abspath parameter to read sensitive files like wp-config.php or execute remote code.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-98

References (4)

https://brandfolder.com

https://wordpress.org/plugins/brandfolder/

https://www.exploit-db.com/exploits/39591

https://www.vulncheck.com/advisories/wordpress-brandfolder-plugin-local-file-inclusion-via-callback-php

KEV Catalog EPSS Scores Vendors All CVEs