CVE-2025-4689

Deeper analysis

The Ads Pro Plugin for WordPress, a multi-purpose advertising manager available on CodeCanyon, is affected by a chained vulnerability that enables local file inclusion leading to remote code execution in all versions through 4.89. The root issues are an SQL injection flaw combined with a local file inclusion weakness that can be leveraged after an image upload, allowing an attacker to place and then execute PHP code on the server. The flaw is tracked as CWE-98 and carries a CVSS 3.1 score of 9.8.

Unauthenticated attackers reachable over the network can exploit the issue without any user interaction. By uploading a crafted image, using the SQL injection vector to reference that file, and invoking the local file inclusion path, an attacker can achieve arbitrary code execution with the full privileges of the web server process, resulting in complete compromise of confidentiality, integrity, and availability.

Public references point to the vendor page on CodeCanyon and a detailed Wordfence threat-intel entry; administrators should consult those sources for available updates or configuration guidance. The EPSS score remains low and flat at 0.0119 with no observed rise after disclosure.