CVE-2016-20101 Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php

Q: What is CVE-2016-20101?

CVE-2016-20101 is a critical vulnerability in Pedro Marcelo Issuu Panel, published on 20 Oct 2026.

Q: Is CVE-2016-20101 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-20101 exists.

Q: How do I fix CVE-2016-20101?

No fix has been published for CVE-2016-20101 yet. Limit exposure of the affected software until one is available.

Critical 9.2 Published 20 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2016-20101?

CVE-2016-20101 is a critical vulnerability in Pedro Marcelo Issuu Panel, published on 20 Oct 2026.

Official description

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

Weakness: CWE-98

Which versions are affected by CVE-2016-20101?

How do I fix CVE-2016-20101?

No fix has been published for CVE-2016-20101 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-20101 being exploited?