CVE-2016-10960

HIGH EXPLOITED NUCLEI

wsecure < 2.4 - Remote Code Execution via wsecure-config.php Publish Parameter

Title source: llm

CVE-2016-10960 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.

WordPress wSecure Lite < 2.4 - Remote Code Execution

HIGHby daffainfo

Core 2

Core References

Release Notes x_refsource_misc

Exploit, Third Party Advisory x_refsource_misc

CVSS v3 8.8

EPSS 0.0898

EPSS Percentile 94.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

VulnCheck KEV 2025-10-08

CWE

CWE-20

Status published

Products (1)

joomlaserviceprovider/wsecure < 2.4

Published Sep 16, 2019

Tracked Since Feb 18, 2026