CVE-2016-20100 Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2016-20100?
CVE-2016-20100 is a high-severity vulnerability in Ian Howatson Memphis Documents Library, published on 20 Oct 2026.
Official description
Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
Weakness: CWE-22
Which versions are affected by CVE-2016-20100?
How do I fix CVE-2016-20100?
No fix has been published for CVE-2016-20100 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-20100 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-20100 exists.
Sources
Also known as GHSA-322h-ww5h-3m7g.