PT-2026-20589 · WordPress · Advanced Ads – Ad Manager & Adsense

Supakiad S · Publicado 2026-02-19 · Atualizado 2026-02-23 · CVE-2025-12884

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advanced Ads – Ad Manager & AdSense plugin for WordPress versions through 2.0.14

Description The Advanced Ads – Ad Manager & AdSense plugin for WordPress has an authorization issue in versions up to and including 2.0.14. The plugin does not properly validate user authorization when performing actions within the placement update item() function. This allows authenticated attackers with subscriber-level access or higher to modify ad placements, potentially changing the served ads or ad groups.

Recommendations Update to a version of Advanced Ads – Ad Manager & AdSense plugin for WordPress later than 2.0.14.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2025-12884

Produtos afetados

Advanced Ads – Ad Manager & Adsense

Referências · 6

• https://plugins.trac.wordpress.org/browser/advanced-ads/tags/2.0.13/includes/admin/class-ajax.php#L886-L932 · Nota
• https://twitter.com/CVEnew/status/2025892092203983326 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3427297 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-12884 · Nota de Segurança
• https://t.me/CVEtracker/45059 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/a1ad32fb-929e-4181-8789-df50a77a71ef?source=cve · Nota