The Broadstreet Ad Widget plugin for WordPress, versions prior to 2.12.0, contains a local file inclusion flaw that allows authenticated users to execute arbitrary PHP code. By supplying unsanitized directory traversal sequences in the step parameter, an attacker can include local files, including those containing malicious scripts, through the require call in views/modal/index.php. This vulnerability can lead to full site compromise or execution of arbitrary code within the web server context.

Vendors Broadstreet, product Ad Widget, are affected on WordPress installations that use any version of the plugin older than 2.12.0. This includes releases from 2.2.0 up through 2.11.x. The canonical plugin is identified by organizational name Broadstreet:Ad Widget in CNA records. No other WordPress plugins or themes are directly impacted.

The CVSS score of 7.7 indicates a high severity vulnerability with potential for arbitrary code execution. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires user authentication to the WordPress site, but once authenticated, directory traversal and null byte injection can be used to include and execute arbitrary files. The Shadowserver Foundation observed exploitation attempts as recently as 2023‑10‑19, suggesting that attackers are actively looking for opportunities to exploit this issue in the wild. Administrators should treat this as a high‑risk problem pending update.