CVE-2025-4689
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-07-02

Last updated on: 2025-07-08

Assigner: Wordfence

Description
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server upload image files on the server than can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-07-02
Last Modified
2025-07-08
Generated
2026-05-07
AI Q&A
2025-07-02
EPSS Evaluated
2026-05-05
NVD
CVE-2025-4689
EUVD
EUVD-2025-19688
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
scripteo ads_pro to 4.89 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Ads Pro Plugin for WordPress up to version 4.89. It involves a combination of SQL Injection and Local File Inclusion vulnerabilities. An attacker can upload image files to the server, then use the SQL Injection flaw to retrieve those files, and finally exploit the Local File Inclusion vulnerability to execute malicious PHP code on the server without authentication.


How can this vulnerability impact me? :

This vulnerability can allow unauthenticated attackers to execute arbitrary code on your server, potentially leading to full system compromise. This can result in data theft, website defacement, unauthorized access, and disruption of services.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart