PT-2026-49218 · Undefined · Undefined

Published 2026-06-15 · Updated 2026-06-15 · CVE-2016-20080

NVD

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to include arbitrary files by manipulating the wp abspath parameter. Attackers can supply path traversal sequences or remote URLs through the wp abspath parameter to read sensitive files like wp-config.php or execute remote code.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2016-20080

Affected Products

Undefined

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-20080 · Security Note
• https://exploit-db.com/exploits/39591 · Note
• https://vulncheck.com/advisories/wordpress-brandfolder-plugin-local-file-inclusion-via-callback-php · Note
• https://brandfolder.com · Note
• https://wordpress.org/plugins/brandfolder · Note