What the vulnerability does
01Description
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.89. This is due to missing or incorrect nonce validation on the bsaCreateAdTemplate function. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
The Ads Pro Plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting versions 4.89 and earlier. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unauthorized actions such as modifying plugin settings, creating ads, or changing configurations without the admin's knowledge or consent.
What an attacker can do
03Attacker Capabilities
Perform unauthorized actions on the site (modify settings, create ads, change configurations) by tricking an admin into visiting a malicious page.
Potential impact on your site
04Site Impact
An attacker can modify your ad settings, create unwanted ads, or change plugin configuration without your permission if you visit a malicious link while logged in.
Conditions required to exploit
05Prerequisites
Site admin must be logged in and visit an attacker-controlled webpage; no special plugin configuration required.
Key dates
06Disclosure timeline
July 2, 2025
CVE published
April 8, 2026
Record updated
