CVE-2020-36728

CRITICAL 9.8CVE-2020-36728 · Published 07/06/2023 · updated 17/06/2026

In short

CVE-2020-36728 is a CRITICAL (CVSS 9.8) vulnerability affecting adning advertising (tunasite).
Chance of exploitation in the next 30 days (EPSS): 3.1%, higher than 87.9% of all vulnerabilities.
Fix: update to 1.5.6 or later.

Package	Affected versions	Patched versions
adning advertising tunasite	`< 1.5.6`	`1.5.6`

Description

The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1.5.5. This allows unauthenticated attackers to delete arbitrary files which can be used to reset and gain full control of a site.

References

blog.nintechnet.com/critical-vulnerability-in-adning-advertising-plugin-actively-exploited-in-the-wild · Third Party Advisory
codecanyon.net/item/wp-pro-advertising-system-all-in-one-ad-manager/269693 · Product
wordfence.com/blog/2020/07/critical-vulnerabilities-patched-in-adning-advertising-plugin · Exploit
wordfence.com/threat-intel/vulnerabilities/id/e7506429-7f8a-45b5-b1b0-6fdb39599ee5 · Third Party Advisory

More vulnerabilities in adning advertising

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free