CVE-2016-20077

Name of the Vulnerable Software and Affected Versions Photocart Link version 1.6

Description Insufficient input validation in the 'decode.php' endpoint allows unauthenticated attackers to perform local file inclusion, which is a flaw that enables the reading of files on the local server. By providing base64-encoded file paths through the id parameter, an attacker can retrieve sensitive files, such as 'wp-config.php', which contains configuration data and database credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.