Is CVE-2017-20289 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-20289 being exploited in the wild.

How severe is CVE-2017-20289?

High severity, with a CVSS score of 7.5, published 22 October 2026.

Which products and versions are affected?

Broadstreet Ad Widget 2.2.0 before 2.12.0.

Is there a fix for CVE-2017-20289?

Yes: fixed in 2.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-20289 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2017-20289?

Check whether you run Broadstreet Ad Widget at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-20289: Broadstreet Ad Widget local file inclusion in modal

CVE-2017-20289 · Severity: high · CVSS 7.5 · Published 2026-10-22

The Broadstreet Ad Widget plugin for WordPress allows administrators to manage advertisements on their sites. Authenticated administrators can be tricked into clicking a malicious link that executes arbitrary PHP code on the server, potentially leading to full site compromise or data theft. An attacker must socially engineer an admin into clicking the crafted URL, but the impact is severe since WordPress administrators control all site content.

Vendors: Broadstreet.

Quick answers

Is CVE-2017-20289 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-20289 being exploited in the wild.
How severe is CVE-2017-20289?: High severity, with a CVSS score of 7.5, published 22 October 2026.
Which products and versions are affected?: Broadstreet Ad Widget 2.2.0 before 2.12.0.
Is there a fix for CVE-2017-20289?: Yes: fixed in 2.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-20289 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2017-20289?: Check whether you run Broadstreet Ad Widget at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.12.0

Technical details

A local file inclusion vulnerability exists in views/modal/index.php where the 'step' GET parameter is passed unsanitized to a require statement, allowing directory traversal. Authenticated users can supply sequences like ../../../etc/passwd%00 (null byte injection) to load and execute arbitrary PHP files on the system. Exploitation requires authentication but can be leveraged via social engineering against administrators.

Affected products

Broadstreet Ad Widget 2.2.0 before 2.12.0

Timeline

2017-10-10: disclosed
2023-10-19: other: Exploitation evidence first observed by Shadowserver Foundation
2026-10-22: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.