CVE-2016-20079: WordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.php

Severity: medium (CVSS 6.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-15 · updated 2026-06-17
Weakness: CWE-98

Description

WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the gateway parameter. Attackers can supply file paths with directory traversal sequences or null byte injection to the gateway parameter in proccess.php to read sensitive files like configuration and system files.

Affected products

jamie Dharma Booking: through 2.28.3

References

https://wordpress.org/plugins/dharma-booking/
https://www.exploit-db.com/exploits/39592
https://www.vulncheck.com/advisories/wordpress-dharma-booking-local-file-inclusion-via-proccess-php

Get alerted when CVE-2016-20079 or the next vulnerability affects your stack