CVE-2016-20064

WP Vault version 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped parameter in the include functionality. Attackers can supply directory traversal sequences through the wpv-image GET parameter to access sensitive files like system configuration and credentials.

This vulnerability poses a serious risk to the organization's security, allowing attackers to access confidential information, which may lead to further attacks or system compromise.

It is recommended to update WP Vault to the latest version that fixes this vulnerability and to implement appropriate security measures to restrict access to sensitive files.