CVE-2016-20064 WP Vault 0.8.6.6 Local File Inclusion via wpv-image Parameter
Unauthenticated attackers can read arbitrary files via directory traversal in the wpv-image parameter of the WP Vault plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-20064?
CVE-2016-20064 is a medium-severity path traversal vulnerability in myasui WP Vault, published on 9 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped parameter in the include functionality. Attackers can supply directory traversal sequences through the wpv-image GET parameter to access sensitive files like system configuration and credentials.
Weakness: CWE-98
Which versions are affected by CVE-2016-20064?
How do I fix CVE-2016-20064?
No fix has been published for CVE-2016-20064 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2016-20064 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-20064 exists.
Sources
Also known as GHSA-wqf8-xh9h-w6pf.