WordPress Ads Pro plugin <= 4.89 - Local File Inclusion vulnerability

The primary impact of this LFI vulnerability is the potential for sensitive information disclosure. An attacker could leverage this flaw to read configuration files, source code, or other files containing credentials, API keys, or proprietary data. Successful exploitation could lead to further compromise of the system, including data breaches and unauthorized access. While the vulnerability is classified as Local File Inclusion, the potential for escalating privileges or gaining access to critical system resources depends on the files accessible through the inclusion mechanism. The blast radius extends to any data accessible through files on the server.

1. आरक्षित2025-04-24
2. प्रकाशित2025-05-23
3. संशोधित2026-04-28
4. EPSS अद्यतन2026-03-23

Without a patched version of Ads Pro available, immediate mitigation focuses on restricting file access and validating user input. Implement strict file access controls to limit the files that can be included. Thoroughly validate any user-supplied input used in file paths to prevent attackers from manipulating the inclusion process. Consider using a Web Application Firewall (WAF) to filter malicious requests and block attempts to exploit the vulnerability. Regularly review and update server configurations to minimize the attack surface. After implementing these mitigations, verify their effectiveness by attempting to trigger the vulnerability with controlled input and confirming that file access is restricted.