Back to CVE Browser

CVE-2020-36705

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1620%

EPSS Percentile22.55th

PublishedJun 7, 2023

Last ModifiedApr 8, 2026

Vulnerability Description

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Affected Platforms (CPE)

📦

Tunasite

Adning Advertising

< 1.5.6

References & Advisories

🔗 https://blog.nintechnet.com/critical-vulnerability-in-adning-advertising-plugin-actively-exploited-in-the-wild/

🔗 https://codecanyon.net/item/wp-pro-advertising-system-all-in-one-ad-manager/269693

🔗 https://wpscan.com/vulnerability/e9873fe3-fc06-4a52-aa32-6922cab7830c

🔗 https://www.wordfence.com/blog/2020/07/critical-vulnerabilities-patched-in-adning-advertising-plugin/

🔗 https://www.wordfence.com/threat-intel/vulnerabilities/id/4a263b74-e9ae-4fd2-be9b-9b8e9eee5982?source=cve

🔗 https://blog.nintechnet.com/critical-vulnerability-in-adning-advertising-plugin-actively-exploited-in-the-wild/

🔗 https://codecanyon.net/item/wp-pro-advertising-system-all-in-one-ad-manager/269693

🔗 https://wpscan.com/vulnerability/e9873fe3-fc06-4a52-aa32-6922cab7830c

Related Vulnerabilities

CVE-2020-367286.5

The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1....

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Mes...

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust...

Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc all...