Executive brief
WP Vault, an older WordPress plugin, contains a security flaw that allows unauthorized individuals to view sensitive files on the web server. By sending a specially crafted web request, an attacker could read system configuration files or credentials, potentially leading to a full compromise of the website. The plugin has been discontinued and is no longer available for download, meaning no official fix will be released.
Technical details
A local file inclusion (LFI) vulnerability exists in WP Vault version 0.8.6.6 due to improper sanitization of the 'wpv-image' GET parameter. The root cause is a CWE-98 failure where the parameter is passed directly to a PHP include/require statement without escaping. An unauthenticated attacker can use directory traversal sequences (e.g., ../../) to access sensitive local files such as /etc/passwd or WordPress configuration files. While the attack vector is listed as local in CVSS metrics, it is triggered via a web request. The plugin was closed on the WordPress repository in 2008 and is considered end-of-life; users should migrate to a supported alternative.
Affected products
- myasui WP Vault 0.8.6.6
Timeline
- 2016-11-12: disclosed: Vulnerability discovered by researcher Lenon Leite
- 2016-11-30: other: Exploit published on Exploit-DB
- 2026-06-09: advisory: CVE published/updated in NVD dataset