Cpe:2.3:a:broadstreet:broadstreet_ad_widget:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3abroadstreetbroadstreet_ad_widgetwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 14:14:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBroadstreet Ad Widget: Local File Inclusion in views/modal/index.php (CVE-2017-20289)https://feed.craftedsignal.io/briefs/2026-10-broadstreet-ad-widget-lfi/Thu, 22 Oct 2026 14:14:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-broadstreet-ad-widget-lfi/The Broadstreet Ad Widget WordPress plugin (versions 2.2.0 through 2.11.9) is vulnerable to authenticated local file inclusion via directory traversal in the 'step' parameter, allowing for arbitrary PHP code execution.Broadstreet Ad Widget versions 2.2.0 through 2.11.9 contain a local file inclusion (LFI) vulnerability. The vulnerability resides in views/modal/index.php, where the step parameter is processed without sufficient sanitization before being passed to a PHP require statement. Authenticated attackers can leverage directory traversal sequences, potentially combined with null bytes, to include and execute arbitrary local PHP files. This vulnerability has been documented as exploited in the wild since October 19, 2023.

Impact

Successful exploitation allows authenticated attackers to execute arbitrary PHP code on the underlying web server, potentially leading to full site compromise.

Recommendation

  • Upgrade the Broadstreet Ad Widget plugin to version 2.12.0 or later immediately.
  • Audit logs for HTTP GET or POST requests containing directory traversal sequences (e.g., ../) targeting views/modal/index.php.
  • Restrict administrative or plugin-configuration access to known, trusted users to prevent unprivileged exploitation.
]]>highthreatwordpresslfiweb-vulnerability