CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.14 via the 'change-ad__content' shortcode parameter. This allows authenticated attackers with editor-level permissions or above, to execute code on the server.
Explanation of Vulnerability in Simple Terms
Advanced Ads allows high-privilege users to inject and execute arbitrary code through an unvalidated input field. An attacker with admin or editor access can craft malicious input that runs as PHP on the site, compromising the entire installation. All versions up to 2.0.14 are affected. Update immediately to a version newer than 2.0.14.
What an attacker can do
Run arbitrary PHP code on the site with full server privileges.
Potential impact on your site
A compromised admin account can execute code, steal data, modify content, or take the site offline.
Conditions required to exploit
Attacker must have admin or editor-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
