Overview
A critical vulnerability has been discovered in all versions of the Ads Pro Plugin – Multi-Purpose WordPress Advertising Manager plugin for WordPress, up to and including version 4.89. This vulnerability, identified as CVE-2025-6459, exposes websites to potential system compromise and data leakage. Given the widespread use of WordPress and its plugins, this vulnerability could have far-reaching implications for site owners, potentially allowing unauthenticated attackers to gain unauthorized access to sensitive data and systems.
Vulnerability Summary
CVE ID: CVE-2025-6459
Severity: High (8.8 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: System compromise or data leakage
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
Ads Pro Plugin – Multi-Purpose WordPress Advertising Manager | Up to and including 4.89
How the Exploit Works
The vulnerability arises due to missing or incorrect nonce validation on the `bsaCreateAdTemplate` function. This weakness in validation allows an attacker to forge a request and inject arbitrary PHP code. If an unauthenticated attacker can trick a site administrator into performing an action such as clicking a link (a typical CSRF attack), the attacker’s injected code can be executed, potentially leading to system compromise and data leakage.
Conceptual Example Code
The following is a conceptual representation of a malicious HTTP request exploiting the vulnerability:
POST /bsaCreateAdTemplate HTTP/1.1
Host: vulnerable-website.com
Content-Type: application/x-www-form-urlencoded
ad_id=123&ad_template=<php code injection>In this example, `
Mitigation
To mitigate the CVE-2025-6459 vulnerability, apply the vendor-provided patch to the Ads Pro Plugin. If the patch cannot be applied immediately, consider employing a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as temporary mitigation.
Remember, it’s crucial to always keep your systems and plugins updated to prevent becoming a victim of such vulnerabilities.