Advanced Ads <= 2.0.14 - Exécution de code à distance authentifiée (Éditeur+) via Shortcode

Successful exploitation of CVE-2025-13592 allows an attacker to gain complete control over the WordPress server. This could lead to data breaches, website defacement, malware installation, and further compromise of the underlying system. The attacker needs editor-level permissions, which are commonly granted to content creators and administrators. Given the widespread use of WordPress and the Advanced Ads plugin, this vulnerability has a potentially large attack surface. The ability to execute arbitrary code represents a critical security risk, enabling attackers to bypass standard security controls and escalate their privileges.

Websites using the Advanced Ads plugin, particularly those with multiple users having editor-level permissions, are at risk. Shared hosting environments where multiple WordPress sites share the same server are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.

• wordpress: Use wp-cli to check the plugin version: wp plugin version advanced-ads. If the version is less than 2.0.15, the system is vulnerable. • wordpress: Search plugin files for the change-adcontent parameter and any code that processes it without proper sanitization. • *generic web:* Monitor web server access logs for requests containing the change-adcontent parameter with unusual or potentially malicious values. Look for patterns indicative of code injection attempts. • wordpress: Use a security scanner plugin to identify the vulnerability and recommend remediation steps.

1. 2025-12-29Disclosure

   disclosure

1. Réservé2025-11-24
2. Publiée2025-12-29
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-13592 is to immediately upgrade the Advanced Ads plugin to version 2.0.15 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider restricting access to the 'change-ad__content' shortcode parameter to trusted users only. While not a complete fix, this can reduce the attack surface. Web application firewalls (WAFs) configured to detect and block suspicious requests targeting the shortcode parameter may also provide some protection. After upgrading, verify the plugin's functionality and confirm that the vulnerability is no longer exploitable by attempting to access the affected shortcode with various inputs.

Installations actives

100KPopulaire

Note du plugin