CVE-2016-20064

MEDIUM 6.2

WP Vault 0.8.6.6 Local File Inclusion via wpv-image Parameter

CVSS Score

6.2

EPSS Score

0.0%

EPSS Percentile

0th

WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped parameter in the include functionality. Attackers can supply directory traversal sequences through the wpv-image GET parameter to access sensitive files like system configuration and credentials.

CWE	CWE-98
Vendor	myasui
Product	wp vault
Published	Jun 9, 2026
Last Updated	Jun 9, 2026

Stay Ahead of the Next One

Get instant alerts for myasui wp vault

Be the first to know when new medium vulnerabilities affecting myasui wp vault are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

myasui / WP Vault

0.8.6.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

exploit-db.com: https://www.exploit-db.com/exploits/40850 wordpress.org: https://wordpress.org/plugins/wp-vault/ lenonleite.com.br: http://lenonleite.com.br/ vulncheck.com: https://www.vulncheck.com/advisories/wp-vault-local-file-inclusion-via-wpv-image-parameter

Credits

Lenon Leite