PT-2026-20589 · WordPress · Advanced Ads – Ad Manager & Adsense

Supakiad S · Published 2026-02-19 · Updated 2026-02-23 · CVE-2025-12884

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advanced Ads – Ad Manager & AdSense plugin for WordPress versions through 2.0.14

Description The Advanced Ads – Ad Manager & AdSense plugin for WordPress has an authorization issue in versions up to and including 2.0.14. The plugin does not properly validate user authorization when performing actions within the placement update item() function. This allows authenticated attackers with subscriber-level access or higher to modify ad placements, potentially changing the served ads or ad groups.

Recommendations Update to a version of Advanced Ads – Ad Manager & AdSense plugin for WordPress later than 2.0.14.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-12884

Affected Products

Advanced Ads – Ad Manager & Adsense

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12884 · Security Note
• https://plugins.trac.wordpress.org/browser/advanced-ads/tags/2.0.13/includes/admin/class-ajax.php#L886-L932 · Note
• https://twitter.com/CVEnew/status/2025892092203983326 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3427297 · Note
• https://t.me/CVEtracker/45059 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a1ad32fb-929e-4181-8789-df50a77a71ef?source=cve · Note