Description
The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.12 via the select_one() function. This is due to the endpoint not properly restricting access to the AJAX endpoint or limiting the functions that can be called to safe functions. This makes it possible for unauthenticated attackers to call arbitrary functions beginning with get_the_ like get_the_excerpt which can make information exposure possible.
Published: 2025-11-01
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Limited Remote Code Execution via unprotected AJAX endpoint
Action: Immediate Patch
AI Analysis

Impact

The Advanced Ads – Ad Manager & AdSense plugin contains a flaw that allows unauthenticated attackers to invoke arbitrary PHP functions whose names begin with "get_the_" through the select_one() AJAX handler. This results in limited code execution or information disclosure by exploiting the plugin’s dynamic function call mechanism, which is a form of improper code generation. The flaw corresponds to CWE-94, Improper Control of Generation of Code.

Affected Systems

The vulnerability affects the Advanced Ads plugin for WordPress versions up to and including 2.0.12, used by websites that rely on monetizemore’s Ad Manager & AdSense tooling.

Risk and Exploitability

The CVSS score of 7.3 indicates a high severity impact, while the EPSS score of less than 1% suggests a low current exploitation likelihood. The exploit requires no special privileges; an attacker can directly target the AJAX endpoint from any unprivileged network location. Since the plugin is widely used, administrators should treat the issue as critical even though it is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on April 22, 2026 at 13:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Advanced Ads plugin version (2.0.13 or later).
  • Verify that the plugin’s AJAX endpoints are not reachable by unauthenticated users by testing them from a non-logged‑in session.
  • Restrict WordPress user roles so that only trusted administrators have permission to configure or use the plugin, and consider disabling the editor capability for lower‑privileged users.

Generated by OpenCVE AI on April 22, 2026 at 13:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Nov 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 03 Nov 2025 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Monetizemore
Monetizemore advanced Ads
Wordpress
Wordpress wordpress
Vendors & Products Monetizemore
Monetizemore advanced Ads
Wordpress
Wordpress wordpress

Sat, 01 Nov 2025 07:00:00 +0000

Type Values Removed Values Added
Description The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.12 via the select_one() function. This is due to the endpoint not properly restricting access to the AJAX endpoint or limiting the functions that can be called to safe functions. This makes it possible for unauthenticated attackers to call arbitrary functions beginning with get_the_ like get_the_excerpt which can make information exposure possible.
Title Advanced Ads <= 2.0.12 - Unauthenticated Limited Code Execution
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Monetizemore Advanced Ads
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:48:06.452Z

Reserved: 2025-09-15T14:29:17.900Z

Link: CVE-2025-10487

cve-icon Vulnrichment

Updated: 2025-11-03T13:23:01.440Z

cve-icon NVD

Status : Deferred

Published: 2025-11-01T07:15:33.610

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-10487

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T14:00:18Z

Weaknesses