Overview
A critical vulnerability has been discovered in all versions of the Ads Pro Plugin – Multi-Purpose WordPress Advertising Manager plugin for WordPress, up to and including version 4.89. This vulnerability, identified as CVE-2025-6459, exposes websites to potential system compromise and data leakage. Given the widespread use of WordPress and its plugins, this vulnerability could have far-reaching implications for site owners, potentially allowing unauthenticated attackers to gain unauthorized access to sensitive data and systems.
Vulnerability Summary
CVE ID: CVE-2025-6459
Severity: High (8.8 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: System compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Ads Pro Plugin – Multi-Purpose WordPress Advertising Manager | Up to and including 4.89
How the Exploit Works
The vulnerability arises due to missing or incorrect nonce validation on the `bsaCreateAdTemplate` function. This weakness in validation allows an attacker to forge a request and inject arbitrary PHP code. If an unauthenticated attacker can trick a site administrator into performing an action such as clicking a link (a typical CSRF attack), the attacker’s injected code can be executed, potentially leading to system compromise and data leakage.
Conceptual Example Code
The following is a conceptual representation of a malicious HTTP request exploiting the vulnerability:
POST /bsaCreateAdTemplate HTTP/1.1
Host: vulnerable-website.com
Content-Type: application/x-www-form-urlencoded
ad_id=123&ad_template=<php code injection>In this example, `
Mitigation
To mitigate the CVE-2025-6459 vulnerability, apply the vendor-provided patch to the Ads Pro Plugin. If the patch cannot be applied immediately, consider employing a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as temporary mitigation.
Remember, it’s crucial to always keep your systems and plugins updated to prevent becoming a victim of such vulnerabilities.