CVE-2016-20080

Name of the Vulnerable Software and Affected Versions WordPress Brandfolder plugin versions 3.0 and earlier

Description An issue in the 'callback.php' file allows unauthenticated attackers to include arbitrary files. By manipulating the wp abspath parameter, attackers can use path traversal sequences or remote URLs to read sensitive files, such as 'wp-config.php', or execute remote code. Local File Inclusion is a flaw that allows an application to include a file from the local file system or a remote server without proper validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.