CVE-2025-10487
HIGH EPSS 34.3%
Published Nov 1, 20258mo ago · Modified Jun 17, 20262w ago
7.3 CVSS 3.1
Published Nov 1, 2025 8mo ago
Last Modified Jun 17, 2026 2w ago
Description
The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.12 via the select_one() function. This is due to the endpoint not properly restricting access to the AJAX endpoint or limiting the functions that can be called to safe functions. This makes it possible for unauthenticated attackers to call arbitrary functions beginning with get_the_ like get_the_excerpt which can make information exposure possible.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability Low
Threat Intelligence
EPSS Exploit Probability
34.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-94 Improper Control of Generation of Code (Code Injection) Injection
References 2
- plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3381123%40advanced-ads&new=3381123%40advanced-ads&sfp_email=&sfph_mail=
- wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/3efe6b81-72db-4419-92a3-26e22ebf46e8?source=cve
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.