Description
WordPress Plugin WordPress Ad Widget is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin WordPress Ad Widget version 2.11.0 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 2.12.0 or latest
References
http://seclists.org/fulldisclosure/2017/Oct/17
https://packetstormsecurity.com/files/144553/WordPress-Ad-Widget-2.10.0-Local-File-Inclusion.html
https://plugins.trac.wordpress.org/changeset/1628751/ad-widget
Related Vulnerabilities
WordPress Plugin Trashbin 'mtb_undelete' Parameter Cross-Site Scripting (0.1)
WordPress Plugin Wp-FileManager 'ajaxfilemanager.php' Arbitrary File Upload (1.2)
WordPress Plugin Starbox-the Author Box for Humans Cross-Site Scripting (3.0.8)
WordPress Plugin Nextend Facebook Connect Unspecified Vulnerability (1.5.7)
WordPress Plugin WP HTML Mail-Email Designer HTML Injection (2.9.0.3)