CVE-2016-20078

WordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.php

Medium6.9Public exploitEPSS 0.69%

Published: 15 Jun 2026
Updated: 28 Jul 2026
Reserved: 15 Jun 2026
Assigned by: VulnCheck

Description

WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the url parameter. Attackers can supply directory traversal sequences in GET requests to pic.php to access sensitive files like wp-config.php containing database credentials and configuration data.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. A reference of the record is tagged as an exploit. CISA's SSVC rates its exploitation: a proof of concept is public.

References tagged exploit1 reference

ExploitDB-39621 (opens in a new tab)exploit

Timeline

2026
15 Jun 2026
15 Jun 2026
ID reserved
By VulnCheck
15 Jun 2026
15 Jun 2026
Published
28 Jul 202643 days later
28 Jul 2026· 43 days later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2016-20078, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium6.9	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	Medium6.2	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Deferred	4.0	Medium6.9	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.69% · top 47% of all CVEs (9 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') (opens in a new tab)All about CWE-98 and its CVEs

Affected products

Henrique Dias · IMDb Profile Widget
- affected 1.0.8

References (3)

ExploitDB-39621 (opens in a new tab)exploit
Official Product Homepage (opens in a new tab)product
VulnCheck Advisory: WordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.php (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2016-20078](https://cveledger.app/badge/CVE-2016-20078.svg)](https://cveledger.app/cve/CVE-2016-20078)

Record last updated 28 Jul 2026, 01:46 UTC.