Live › vulnerability › CVE-2017-20289
Go to dashboardThe Broadstreet Ad Widget plugin for WordPress passes unsanitized input to a PHP require call in views/modal/index.php, so directory traversal in the 'step' parameter can include local files. An authenticated user can use this to execute attacker-chosen PHP code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Broadstreet Ad Widget plugin from version 2.2.0 up to but not including 2.12.0 are exposed. The attacker needs a logged-in account on the site, so sites with only admin-controlled accounts face less risk. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
wp-content/plugins/ (the version is in the plugin header).views/modal/index.php in the plugin directory and check whether it passes the step parameter to require.2.12.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
This page as .md · .json · in your agent: get_signal("CVE-2017-20289")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.