PT-2025-27589 · WordPress · The Ads Pro Plugin

Trương Hữu Phúc + 1 · Published 2025-07-02 · Updated 2025-07-07 · CVE-2025-4689

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager versions up to, and including, 4.89

Description: The issue is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server, upload image files on the server that can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability.

Recommendations: For versions up to, and including, 4.89, update to a version that fixes the Local File Inclusion and SQL Injection vulnerabilities. As a temporary workaround, consider disabling image upload functionality until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-4689

Affected Products

The Ads Pro Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2025-4689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4689 · Security Note
• https://twitter.com/cracbot/status/1942176819945578881 · Twitter Post
• https://t.me/cvenotify/127346 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1940284056748388859 · Twitter Post
• https://twitter.com/CveFindCom/status/1940261814610092362 · Twitter Post
• https://codecanyon.net/item/ads-pro-plugin-multipurpose-wordpress-advertising-manager/10275010 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/038ddfcd-093b-4234-a0b8-a3bf9a3d329f?source=cve · Note