CVE-2016-20064: WP Vault 0.8.6.6 Local File Inclusion via wpv-image Parameter

Severity: medium (CVSS 6.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-09 · updated 2026-07-21
Weakness: CWE-98

Description

WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped parameter in the include functionality. Attackers can supply directory traversal sequences through the wpv-image GET parameter to access sensitive files like system configuration and credentials.

Affected products

myasui WP Vault: 0.8.6.6

References

http://lenonleite.com.br/
https://wordpress.org/plugins/wp-vault/
https://www.exploit-db.com/exploits/40850
https://www.vulncheck.com/advisories/wp-vault-local-file-inclusion-via-wpv-image-parameter

Get alerted when CVE-2016-20064 or the next vulnerability affects your stack