CVE-2017-20289 Details
Description
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
A local file inclusion vulnerability has been identified in the Broadstreet Ad Widget plugin for WordPress, affecting versions 2.2.0 prior to 2.12.0. This vulnerability allows authenticated users to execute PHP files of their choice by sending unsanitized input through the 'step' parameter in 'views/modal/index.php'. Exploitation involves using directory traversal sequences to include local files and execute PHP code. The vulnerability was first noted by the Shadowserver Foundation on October 19, 2023.
Users are advised to update the Broadstreet Ad Widget plugin for WordPress to version 2.12.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cxsecurity.com/issue/WLB-2017100084 | [email protected] | ExploitTechnical Description |
| https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/ad-widget-lfi.yaml | [email protected] | ExploitTechnical Description |
| https://packetstorm.news/files/id/144553/ | [email protected] | Content WallExploit |
| https://plugins.trac.wordpress.org/changeset/1628751/ad-widget | [email protected] | Permission RequiredVendor |
| https://wordpress.org/plugins/ad-widget/ | [email protected] | ProductVendor |
| https://wpscan.com/vulnerability/caca21fe-56bf-4d4c-afc8-4a218e52f0a2 | [email protected] | AdvisoryExploitRemedy |
| https://www.vulncheck.com/advisories/broadstreet-ad-widget-wordpress-plugin-2.12.0-local-file-inclusion-via-step-parameter | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Broadstreet Ad Widget | >= 2.2.0, < 2.12.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |