CVE-2017-20289 in Ad Widget Plugin
Summary
by MITRE • 10/22/2026
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The Broadstreet Ad Widget plugin for WordPress versions prior to 2.12.0 contains a critical Local File Inclusion vulnerability that poses significant risks to web application security and server integrity. This flaw resides within the views/modal/index.php file, where user-supplied input is passed directly into PHP's require function without adequate sanitization or validation. The specific parameter targeted by this vulnerability is step, which accepts values from authenticated users. Because the plugin requires authentication for most administrative functions, an attacker must first obtain valid credentials to exploit this issue. However, once access is granted, the lack of input filtering allows the injection of directory traversal sequences such as ../ into the step parameter. This technique enables the inclusion and subsequent execution of arbitrary local files on the server, effectively bypassing intended security controls within the application logic.
The technical mechanism behind this vulnerability relies on PHP's file handling functions interpreting path separators to navigate outside the expected directory structure. By appending null bytes or using standard traversal characters, an attacker can redirect the require statement to point at sensitive system files or maliciously crafted scripts stored elsewhere in the web root. This capability transforms a simple inclusion flaw into a Remote Code Execution vector if the included file contains executable PHP code or if the server configuration allows for further exploitation through existing files like wp-config.php or other administrative interfaces. The presence of null byte support in older PHP configurations exacerbates this risk, as it can truncate expected path extensions and allow access to binary or non-PHP files that might still be processed by the interpreter under specific conditions.
The operational impact of this vulnerability is severe, potentially leading to complete compromise of the WordPress installation and the underlying server infrastructure. Successful exploitation allows attackers to read sensitive configuration files containing database credentials, API keys, and secret salts, which can facilitate further attacks such as SQL injection or session hijacking. Furthermore, if an attacker manages to include a file that executes arbitrary commands, they gain full control over the web application environment. This level of access permits data exfiltration, defacement, installation of backdoors, and use of the compromised server for distributed denial-of-service attacks or mining cryptocurrency. The fact that exploitation evidence was first observed by the Shadowserver Foundation on October 19, 2023 indicates active real-world targeting, highlighting the urgency for immediate remediation to prevent ongoing unauthorized access and data breaches.
From a classification perspective, this vulnerability aligns with CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program, which describes flaws where user input is used directly in file inclusion operations without proper validation. It also maps to MITRE ATT&CK technique T1504.003 Web Shell: Local File Inclusion, as the exploitation path typically involves including a web shell or existing administrative scripts to maintain persistent access and execute commands remotely. The requirement for authentication places this within the context of authenticated attacks, often categorized under privilege escalation if lower-level accounts can trigger actions intended only for administrators.
To mitigate this vulnerability, organizations must immediately update the Broadstreet Ad Widget plugin to version 2.12.0 or later, where the input validation and sanitization logic has been corrected to prevent directory traversal sequences from being processed by the require function. Administrators should also enforce strict least-privilege principles for user accounts within WordPress, ensuring that only essential personnel have access to administrative features. Additionally, implementing a Web Application Firewall can provide an additional layer of defense by blocking requests containing suspicious patterns such as ../ or null bytes in query parameters. Regular security audits and monitoring for unusual file inclusion attempts are recommended to detect potential exploitation activities early and maintain the integrity of the web application environment.