Description
WordPress Plugin WordPress Ad Widget is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin WordPress Ad Widget version 2.11.0 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 2.12.0 or latest
References
http://seclists.org/fulldisclosure/2017/Oct/17
https://packetstormsecurity.com/files/144553/WordPress-Ad-Widget-2.10.0-Local-File-Inclusion.html
https://plugins.trac.wordpress.org/changeset/1628751/ad-widget
Related Vulnerabilities
Joomla Numeric Errors Vulnerability (CVE-2008-4102)
Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-0096)
Joomla Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2020-15697)
WordPress Plugin bbPress Members Only Cross-Site Request Forgery (1.2.1)