Description

WordPress Plugin WordPress Ad Widget is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin WordPress Ad Widget version 2.11.0 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 2.12.0 or latest

References

http://seclists.org/fulldisclosure/2017/Oct/17

https://packetstormsecurity.com/files/144553/WordPress-Ad-Widget-2.10.0-Local-File-Inclusion.html

https://plugins.trac.wordpress.org/changeset/1628751/ad-widget

Related Vulnerabilities

WordPress Plugin Contact Form by Supsystic Multiple Vulnerabilities (1.7.5)

WordPress Plugin Count per Day Arbitrary File Download and Cross-Site Scripting Vulnerabilities (3.1)

WordPress Plugin Search Exclude Security Bypass (1.2.2)

WordPress Plugin MAC PHOTO GALLERY 'albid' Parameter Arbitrary File Disclosure (2.8)

WordPress 4.5.x Multiple Vulnerabilities (4.5 - 4.5.13)

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Tags

Missing Update File Inclusion