CVE-2025-10487: RCE in Advanced Ads – Ad Manager

The impact of this RCE vulnerability is significant. An attacker could leverage it to gain complete control over a WordPress site running the vulnerable plugin. This could involve deploying malware, stealing sensitive data (user credentials, customer information, database contents), modifying website content, or using the compromised site as a launchpad for further attacks against other systems on the network. The ability to call functions like gettheexcerpt demonstrates the potential for information exposure, which could be a precursor to more serious attacks. The unauthenticated nature of the exploit means that no user interaction is required for exploitation.

1. Reserved2025-09-15
2. Published2025-11-01
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade the Advanced Ads plugin to version 2.0.13 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting access to the vulnerable AJAX endpoint. This can be achieved through a WordPress firewall (WAF) or by implementing custom access control rules within the plugin itself (though this requires advanced development skills). Monitor WordPress access logs for suspicious requests targeting the select_one() function. While a direct detection signature is difficult without plugin code access, look for unusual function calls originating from the plugin.

Active installs

100KPopular

Plugin rating