What the vulnerability does
01Description
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server upload image files on the server than can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Ads Pro Plugin for WordPress contains a critical vulnerability that allows unauthenticated attackers to execute arbitrary code on affected sites. No user interaction or special configuration is required. All versions up to 4.89 are vulnerable. Site administrators should update immediately to a patched version.
What an attacker can do
03Attacker Capabilities
Run their own code on the site without logging in.
Potential impact on your site
04Site Impact
Complete compromise of the WordPress site, including data theft, malware injection, and site takeover.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 2, 2025
CVE published
April 8, 2026
Record updated
