CVE-2016-20080

Vulnerability

The WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in the callback.php file [1][3]. The plugin’s callback.php script directly uses the $_REQUEST['wp_abspath'] parameter to construct paths for require_once statements, including wp-load.php and other core files [3]. An unauthenticated attacker can manipulate this parameter with path traversal sequences or remote URLs, leading to arbitrary file inclusion [3][4]. The vulnerable versions are those up to and including 3.0 [3][4].

Exploitation

An unauthenticated attacker needs only network access to the WordPress installation. By sending a crafted HTTP request to the callback.php endpoint, the attacker supplies a wp_abspath parameter containing path traversal characters such as ../../../ or a full remote URL (e.g., http://evil/) [3]. The code will then include the attacker-controlled file, which can be a local file like wp-config.php or a remote file hosted on an attacker’s server [3][4]. No authentication or special privileges are required [4].

Impact

Successful exploitation allows the attacker to read sensitive local files such as wp-config.php, which often contains database credentials [3][4]. If remote file inclusion is possible, the attacker can execute arbitrary PHP code on the server by including a malicious wp-load.php from their own host [3][4]. This can lead to full site compromise, including data theft, privilege escalation, and persistent backdoor access. The CIA impact is high for confidentiality and can become total with code execution [4].

Mitigation

As of the latest available plugin update, no patched version has been released [1][3]. Users are advised to remove or disable the Brandfolder plugin entirely until a fix is provided [1][3]. Given that the plugin connects to external Brandfolder API services [1], an alternative solution may be to replace it with an actively maintained plugin. The vulnerability has been publicly disclosed with proof-of-concept code [3], increasing the risk of exploitation.