VULNERABILITY INTELLIGENCE
CVE-2020-36728
CVSS score6.5 MEDIUM
EPSS probability3.13%
CISA KEVNot currently listed
Published2023-06-07
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Description
The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1.5.5. This allows unauthenticated attackers to delete arbitrary files which can be used to reset and gain full control of a site.
Weakness classification
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Primary references
- security@wordfence.com — Third Party Advisory
- security@wordfence.com — Product
- security@wordfence.com — Exploit, Third Party Advisory
- security@wordfence.com — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Product
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory