CVE-2016-10991

Vulnerability

The imdb-widget plugin for WordPress, versions before 1.0.9, contains a local file inclusion (LFI) vulnerability. The flaw resides in how the plugin handles file paths, allowing an attacker to specify and include arbitrary files from the server without proper sanitization. This affects all installations using versions earlier than 1.0.9.

Exploitation

An attacker can exploit this vulnerability by sending a crafted request to the vulnerable endpoint where the plugin includes files based on user input. No authentication is required, and the attack can be performed remotely over HTTP. The attacker only needs to manipulate a parameter (likely related to a file path) to traverse directories and include files like wp-config.php.

Impact

Successful exploitation allows an unauthenticated attacker to read sensitive files on the server, including the WordPress configuration file (wp-config.php), which contains database credentials and other secrets. This can lead to full site compromise, including data theft and potential server-level access.

Mitigation

The plugin has been closed and removed from the WordPress.org plugin directory as of December 19, 2017 [1]. Users who have it installed should uninstall it immediately, as no patched version is available for download. The recommended mitigation is to replace the plugin with an alternative solution. As of the publication date of this CVE (2019-09-17), the plugin is still considered vulnerable with no official fix distributed.