CVE-2016-20064 MEDIUM

CVE-2016-20064: WP Vault 0.8.6.6 Local File Inclusion via wpv-image Parameter

Vendor Myasui
Product WP Vault
Weakness CWE-98 · PHP file inclusion
Published June 9, 2026
Last update June 9, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped parameter in the include functionality. Attackers can supply directory traversal sequences through the wpv-image GET parameter to access sensitive files like system configuration and credentials.

Key dates

02Disclosure timeline

June 9, 2026 CVE published
June 9, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-11722 Category and Products Accordion Panel <= 1.0 - Authenticated (Contributor+) Local File Inclusion CVE-2024-37520 WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 2.1.12 - Local File Inclusion vulnerability CVE-2024-10871 Category Ajax Filter <= 2.8.2 - Unauthenticated Local File Inclusion CVE-2025-58931 WordPress Palatio theme <= 1.6 - Local File Inclusion vulnerability CVE-2025-30849 WordPress Essential Real Estate plugin <= 5.2.0 - Local File Inclusion Vulnerability