What is GHSA-p4fg-v7c8-vx52?

GHSA-p4fg-v7c8-vx52 is a security advisory published by GitHub Security Advisories with Medium severity. WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows...

Which CVE IDs does GHSA-p4fg-v7c8-vx52 cover?

GHSA-p4fg-v7c8-vx52 covers the following CVE IDs: CVE-2016-20078. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p4fg-v7c8-vx52?

GHSA-p4fg-v7c8-vx52 has a CVSS v3 base score of 6.2, published by GitHub Security Advisories.

GHSA-p4fg-v7c8-vx52MediumCVSS 6.2

WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows...

Vendor

GitHub Security Advisories

Published

June 15, 2026

Last Modified

June 15, 2026

🔗 CVE IDs covered (1)

CVE-2016-20078 →

📋 Description

WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the url parameter. Attackers can supply directory traversal sequences in GET requests to pic.php to access sensitive files like wp-config.php containing database credentials and configuration data.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2016-20078
https://wordpress.org/plugins/imdb-widget
https://www.exploit-db.com/exploits/39621
https://www.vulncheck.com/advisories/wordpress-imdb-profile-widget-local-file-inclusion-via-pic-php
https://github.com/advisories/GHSA-p4fg-v7c8-vx52