Memphis Documents Library WordPress plugin: Path traversal via mdocs-img-preview
Summary
The Memphis Documents Library (mDocs) WordPress plugin before version 3.1.6 contains a path traversal vulnerability in the mdocs-img-preview parameter. An unauthenticated remote attacker can send crafted GET requests to read arbitrary files on the web server, for example wp-config.php, which contains database credentials. Public proof-of-concept code exists, and the plugin has been closed on WordPress.org since December 2021, so an official fix may no longer be available.
Affected
- Memphis Documents Library WordPress plugin (Ian Howatson) before 3.1.6
- Affected range start is disputed across sources (2.2.1 or 2.3); treat all versions before 3.1.6 as affected
- Versions 3.10.x: status unknown, do not assume they are safe
Fixed in
- Version 3.1.6 (according to the CVE record, Exploit-DB and WPScan)
- Availability of 3.1.6 on WordPress.org: Unknown. The plugin was closed on WordPress.org on December 3, 2021.
Workaround
- No vendor workaround known.
- Removing or deactivating the plugin is the most reliable measure.
- A web application firewall may serve as a temporary stopgap only.
Exploitation
- Unauthenticated remote exploitation via GET requests with directory traversal sequences; no user interaction required.
- Public proof of concept available (Exploit-DB 39593, Packet Storm, Nuclei template).
- Exploitation evidence reported by Shadowserver on 2023-10-22 (second-hand, unverified).
- Not listed in CISA KEV.
- CISA SSVC: Exploitation PoC, automatable: yes.
Our recommendation
- Inventory all WordPress sites for the memphis-documents-library plugin and record the version.
- Remove or deactivate the plugin, as it is abandoned and no reliable update path exists.
- Review web server logs for requests to the mdocs-img-preview parameter containing traversal sequences (../).
- If compromise is suspected, rotate database credentials and WordPress salts.
- Check whether any other WordPress plugins or sites share exposed credentials.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Nuclei template wp-memphis-documents-library-lfi github.com
- Packet Storm 136374 packetstorm.news
- WordPress.org plugin page Memphis Documents Library wordpress.org
- WPScan vulnerability 53999c06 wpscan.com
- Exploit-DB 39593 www.exploit-db.com
- VulnCheck advisory Memphis Documents Library 3.1.6 www.vulncheck.com
- WordPress.org plugin advanced page (closure notice) wordpress.org
- OpenCVE CVE-2016-20100 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:25.
Original description (NVD)
Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
NVD references (6)
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-memphis-docu…
- https://packetstorm.news/files/id/136374/
- https://wordpress.org/plugins/memphis-documents-library/
- https://wpscan.com/vulnerability/53999c06-05ca-44f1-b713-1e4d6b4a3f9f
- https://www.exploit-db.com/exploits/39593
- https://www.vulncheck.com/advisories/memphis-documents-library-wordpress-plugin-3.1.6-path-traversal-via-mdoc…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.