CVE-2017-20289: Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Affected Software
Event History
Frequently Asked Questions
Which plugin versions should be treated as affected?
Broadstreet Ad Widget for WordPress versions 2.2.0 through versions before 2.12.0 are affected. Version 2.12.0 is the stated fixed-version boundary.
What level of access does an attacker need?
Exploitation requires an authenticated user with low privileges. No user interaction is required.
Has exploitation been observed in the wild?
Yes. The Shadowserver Foundation first observed exploitation evidence on 2023-10-19.