CVE-2016-20079

Name of the Vulnerable Software and Affected Versions WordPress Dharma Booking versions prior to 2.28.4

Description An issue allows unauthenticated attackers to include arbitrary files by manipulating the gateway parameter in the 'proccess.php' endpoint. By using directory traversal sequences or null byte injection, attackers can read sensitive configuration and system files. Local File Inclusion is a flaw that allows an application to read or execute files on the server that it should not have access to.

Recommendations Update to a version later than 2.28.3. As a temporary workaround, restrict access to the 'proccess.php' endpoint or avoid using the gateway parameter until the update is applied.