CVE-2020-36728 : Security Advisory and Response

A vulnerability in the Adning Advertising plugin for WordPress allows unauthenticated attackers to delete arbitrary files, potentially leading to site compromise.

Understanding CVE-2020-36728

The Adning Advertising plugin for WordPress is susceptible to file deletion through path traversal, impacting versions up to 1.5.5.

What is CVE-2020-36728?

The vulnerability in the Adning Advertising plugin enables attackers to delete files via path traversal, potentially granting unauthorized access to the site.

The Impact of CVE-2020-36728

This vulnerability permits unauthenticated attackers to delete crucial files, potentially leading to a complete site takeover.

Technical Details of CVE-2020-36728

The Adning Advertising plugin vulnerability is detailed below:

Vulnerability Description

Path traversal vulnerability in Adning Advertising plugin
Allows unauthenticated attackers to delete arbitrary files

Affected Systems and Versions

Vendor: tunafish
Product: Adning Advertising
Versions affected: up to and including 1.5.5

Exploitation Mechanism

Attackers exploit path traversal to delete files
Unauthorized deletion can lead to site compromise

Mitigation and Prevention

Protect your system from CVE-2020-36728 with the following steps:

Immediate Steps to Take

Update Adning Advertising plugin to version 1.5.6 or higher
Monitor site for any unauthorized file deletions

Long-Term Security Practices

Regularly update plugins and themes
Implement access controls to prevent unauthorized actions
Conduct security audits to identify vulnerabilities

Patching and Updates

Apply security patches promptly
Stay informed about plugin vulnerabilities and updates