The Ads Pro Plugin – Multi‑Purpose WordPress Advertising Manager suffers from a Local File Inclusion flaw that allows an attacker without authentication to supply arbitrary file paths via the bsa_template parameter in the bsa_preview_callback function. Once the plugin includes the supplied file, any PHP code within that file is executed on the server. This flaw can be leveraged to bypass access controls, steal sensitive data, and potentially achieve full code execution if arbitrary PHP files can be uploaded or if target files already exist on the server. The weakness is identified as CWE‑98.

This vulnerability affects the Ads Pro Plugin – Multi‑Purpose WordPress Advertising Manager supplied by scripteo. All releases up to and including 4.89 are impacted. No information is available regarding further restricted sub‑versions or patch versions. The plugin runs within the WordPress environment, so any WordPress site that has not upgraded beyond 4.89 and still enables the preview callback is susceptible.

The CVSS base score of 8.1 indicates a high‑severity flaw. The EPSS score of 17 % shows that, at the time of analysis, there is a moderate probability that attackers will target this vulnerability. It is not listed in CISA's KEV catalogue, so no publicly known exploits have yet been documented. An attacker can trigger the inclusion by sending a specially crafted HTTP request to the WordPress site containing a bsa_template value that points to a local file, such as a previously uploaded PHP file or a script that can be used to establish persistence. Since the flaw is unauthenticated and local, the attacker only needs network access to the server, making it a practical risk for exposed WordPress installations that do not restrict the plugin’s input. Given the high impact and non‑zero likelihood of exploitation, administrators should act promptly.