CVE-2025-4689
Scripteo Ads Pro ≤ 4.89
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-4689 is a critical-severity PHP Remote File Inclusion (CWE-98) vulnerability in Scripteo Ads Pro. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The Ads Pro Plugin for WordPress, a multi-purpose advertising manager available on CodeCanyon, is affected by a chained vulnerability that enables local file inclusion leading to remote code execution in all versions through 4.89. The root issues are an SQL injection flaw combined with a local file inclusion weakness that can be leveraged after an image upload, allowing an attacker to place and then execute PHP code on the server. The flaw is tracked as CWE-98 and carries a CVSS 3.1 score of 9.8.
Unauthenticated attackers reachable over the network can exploit the issue without any user interaction. By uploading a crafted image, using the SQL injection vector to reference that file, and invoking the local file inclusion path, an attacker can achieve arbitrary code execution with the full privileges of the web server process, resulting in complete compromise of confidentiality, integrity, and availability.
Public references point to the vendor page on CodeCanyon and a detailed Wordfence threat-intel entry; administrators should consult those sources for available updates or configuration guidance. The EPSS score remains low and flat at 0.0119 with no observed rise after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-19688
Vulnerability Data
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a…
more
SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server upload image files on the server than can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and static analysis can discover missing filename restrictions before deployment.
Validating all inputs before they reach include/require statements directly stops untrusted filenames from being used.
Enforcing access authorizations on resources limits what an included file can reach even if a bad name is supplied.
Information-flow rules can block the loading of external or unauthorized files into the PHP process.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices such as input validation and allow-listing of include paths directly prevent the weakness.
Hardened runtime configuration (e.g., allow_url_include=off) directly blocks RFI even if code is flawed.
Execution restrictions can prevent the remote payload from running, while eliminating the weakness reduces the need for such controls.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect RFI but does not prevent the weakness by itself.
Secure development lifecycle mandates input validation and safe include/require patterns that directly prevent remote file inclusion.
Application security requirements explicitly call for controls against injection and unsafe file operations.
Secure architecture principles reduce attack surface but do not specifically address dynamic file inclusion.
Secure coding standards directly require whitelisting and sanitization of filenames used in include/require statements.
Information access restriction limits what files can be read but does not address dynamic inclusion logic.