VYPR
← All advisories
Medium severity6.2NVD Advisory· Published Jun 15, 2026

CVE-2016-20079

CVE-2016-20079

Description

WordPress Dharma Booking plugin ≤2.28.3 has an unauthenticated local file inclusion via the gateway parameter in proccess.php, allowing read of sensitive files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

WordPress Dharma Booking plugin ≤2.28.3 has an unauthenticated local file inclusion via the gateway parameter in proccess.php, allowing read of sensitive files.

Vulnerability

The WordPress Dharma Booking plugin, version 2.28.3 and earlier, contains a local file inclusion (LFI) vulnerability in the file dharma-booking/frontend/ajax/gateways/proccess.php. The script unsafely uses $_GET['gateway'] in a require_once() call without proper sanitization, allowing an attacker to control which file is included. The vulnerability is categorized under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). Affected versions are all releases up to and including 2.28.3 [1][2].

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable endpoint. The attacker manipulates the gateway parameter in the URL, using directory traversal sequences (e.g., ../../../../../../etc/passwd) combined with null byte injection (%00) to terminate the appended .php extension. For example: http://target/wp/dharma-booking/frontend/ajax/gateways/proccess.php?gateway=../../../../../../etc/passwd%00. No authentication or prior access is required [2].

Impact

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the server, including sensitive configuration files, system files, and potentially WordPress credentials. The impact is primarily information disclosure, leading to a compromise of confidentiality. The CVSS v3 severity is Medium at 6.2, with a vector indicating high confidentiality impact but no integrity or availability impact [1].

Mitigation

The Dharma Booking plugin has been closed and is no longer available for download as of March 8, 2015, due to an unknown reason [3]. No patched version has been released. Since the plugin is closed and unsupported, users must remove or deactivate it from any active WordPress installation. There is no known workaround. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing.

References
  1. WordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.php
  2. OffSec’s Exploit Database Archive
  3. dharmaBooking a wordpress accomadation reservation plugin

AI Insight generated on Jun 15, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Unsanitized user input in the `gateway` parameter passed directly to `require_once()` allows arbitrary file inclusion."

Attack vector

An unauthenticated attacker sends an HTTP GET request to `proccess.php` with a crafted `gateway` parameter. By supplying directory traversal sequences (e.g., `../../../../../../etc/passwd%00`) the attacker can include arbitrary files from the server. The null byte (`%00`) truncates the appended `.php` extension, enabling inclusion of non-PHP files. This is a classic local file inclusion (LFI) vulnerability [CWE-98] [ref_id=1].

Affected code

The vulnerable file is `dharma-booking/frontend/ajax/gateways/proccess.php`. It calls `require_once($_GET['gateway'].'.php');` without any sanitization, allowing an attacker to control the included file path.

What the fix does

The advisory does not provide a patch. The fix would require validating and sanitizing the `gateway` parameter to ensure it only allows expected, safe file names, and removing null-byte handling. Without a patch, users must upgrade to a version newer than 2.28.3 or disable the plugin.

Preconditions

  • configThe WordPress Dharma Booking plugin version 2.28.3 or earlier must be installed and active.
  • authNo authentication is required; the attacker can be unauthenticated.
  • networkThe attacker must be able to send HTTP requests to the vulnerable `proccess.php` endpoint.
  • inputThe attacker supplies a `gateway` parameter with directory traversal sequences and/or null byte injection.

Generated on Jun 15, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

0

No linked articles in our index yet.