{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/broadstreet-ad-widget-2.2.0---2.11.9/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:broadstreet:broadstreet_ad_widget:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2017-20289"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Broadstreet Ad Widget (2.2.0 - 2.11.9)"],"_cs_severities":["high"],"_cs_tags":["wordpress","lfi","web-vulnerability"],"_cs_type":"threat","_cs_vendors":["Broadstreet"],"content_html":"\u003cp\u003eBroadstreet Ad Widget versions 2.2.0 through 2.11.9 contain a local file inclusion (LFI) vulnerability. The vulnerability resides in \u003ccode\u003eviews/modal/index.php\u003c/code\u003e, where the \u003ccode\u003estep\u003c/code\u003e parameter is processed without sufficient sanitization before being passed to a PHP \u003ccode\u003erequire\u003c/code\u003e statement. Authenticated attackers can leverage directory traversal sequences, potentially combined with null bytes, to include and execute arbitrary local PHP files. This vulnerability has been documented as exploited in the wild since October 19, 2023.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers to execute arbitrary PHP code on the underlying web server, potentially leading to full site compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Broadstreet Ad Widget plugin to version 2.12.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit logs for HTTP GET or POST requests containing directory traversal sequences (e.g., ../) targeting \u003ccode\u003eviews/modal/index.php\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRestrict administrative or plugin-configuration access to known, trusted users to prevent unprivileged exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T14:14:20Z","date_published":"2026-10-22T14:14:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-broadstreet-ad-widget-lfi/","summary":"The Broadstreet Ad Widget WordPress plugin (versions 2.2.0 through 2.11.9) is vulnerable to authenticated local file inclusion via directory traversal in the 'step' parameter, allowing for arbitrary PHP code execution.","title":"Broadstreet Ad Widget: Local File Inclusion in views/modal/index.php (CVE-2017-20289)","url":"https://feed.craftedsignal.io/briefs/2026-10-broadstreet-ad-widget-lfi/"}],"language":"en","title":"CraftedSignal Threat Feed - Broadstreet Ad Widget (2.2.0 - 2.11.9)","version":"https://jsonfeed.org/version/1.1"}