Skip to content
Threat Feed
Subscribe
high threat

Broadstreet Ad Widget: Local File Inclusion in views/modal/index.php (CVE-2017-20289)

The Broadstreet Ad Widget WordPress plugin (versions 2.2.0 through 2.11.9) is vulnerable to authenticated local file inclusion via directory traversal in the 'step' parameter, allowing for arbitrary PHP code execution.

CVE search metadata

CVE search record: CVE-2017-20289. Severity: high. CVSS: 7.5. KEV: no. Product: Broadstreet Ad Widget (2.2.0 - 2.11.9). Brief: Broadstreet Ad Widget: Local File Inclusion in views/modal/index.php (CVE-2017-20289). Brief link: https://feed.craftedsignal.io/briefs/2026-10-broadstreet-ad-widget-lfi/

Triage facts

Revision 1
Applicability
Broadstreet Ad Widget (2.2.0 - 2.11.9)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 22, 14:14 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

Broadstreet Ad Widget versions 2.2.0 through 2.11.9 contain a local file inclusion (LFI) vulnerability. The vulnerability resides in views/modal/index.php, where the step parameter is processed without sufficient sanitization before being passed to a PHP require statement. Authenticated attackers can leverage directory traversal sequences, potentially combined with null bytes, to include and execute arbitrary local PHP files. This vulnerability has been documented as exploited in the wild since October 19, 2023.

Impact

Successful exploitation allows authenticated attackers to execute arbitrary PHP code on the underlying web server, potentially leading to full site compromise.

Recommendation

  • Upgrade the Broadstreet Ad Widget plugin to version 2.12.0 or later immediately.
  • Audit logs for HTTP GET or POST requests containing directory traversal sequences (e.g., ../) targeting views/modal/index.php.
  • Restrict administrative or plugin-configuration access to known, trusted users to prevent unprivileged exploitation.

Immediate actions

Patch Broadstreet Ad Widget to 2.12.0

IT Operations 24h

Mitigations

Upgrade plugin to 2.12.0

immediate IT Operations

CVE-2017-20289

Detection coverage 1

Detect CVE-2017-20289 Exploitation - LFI via Broadstreet Ad Widget

high

Detects exploitation attempts against CVE-2017-20289 by identifying directory traversal patterns in the 'step' parameter of the vulnerable index.php file.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →