CVE-2016-20082

MEDIUM

WordPress Plugin Abtest Local File Inclusion via abtest_admin.php

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-20082. PoCs published by CrashBandicot.

AI-analyzed exploit summary This exploit demonstrates a Local File Inclusion (LFI) vulnerability in the WordPress Abtest plugin. The vulnerable code in 'abtest_admin.php' directly includes a file based on the 'action' parameter without proper sanitization, allowing an attacker to include arbitrary local files.

Description

WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the action parameter. Attackers can send GET requests to abtest_admin.php with malicious action values to include files from the admin directory and execute arbitrary code.

Exploits (1)

exploitdb WORKING POC
by CrashBandicot · textwebappsphp
https://www.exploit-db.com/exploits/39577

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in the WordPress Abtest plugin. The vulnerable code in 'abtest_admin.php' directly includes a file based on the 'action' parameter without proper sanitization, allowing an attacker to include arbitrary local files.

Classification
Working Poc 90%
Attack Type
Lfi
Complexity
Trivial
Reliability
Reliable
Target: WordPress Plugin Abtest
No auth needed
Prerequisites: WordPress installation with the Abtest plugin active
devstral-2 · analyzed Jun 15, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit exploit
ExploitDB-39577
https://www.exploit-db.com/exploits/39577
Product product
Official Product Homepage
https://github.com/wp-plugins/abtest
Third Party Advisory third-party-advisory
VulnCheck Advisory: WordPress Plugin Abtest Local File Inclusion via abtest_admin.php
https://www.vulncheck.com/advisories/wordpress-plugin-abtest-local-file-inclusion-via-abtest-admin-php

Scores

CVSS v3 6.2
EPSS 0.0033
EPSS Percentile 24.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-98
Status published
Products (1)
abtest/Abtest 1.0.6
Published Jun 15, 2026
Tracked Since Jun 15, 2026