The Ads Pro Plugin for WordPress contains a vulnerability that allows unauthenticated attackers to upload arbitrary image files. An image upload can be combined with a SQL injection flaw to retrieve the uploaded file through a database query, and then a local file inclusion flaw permits the file to be executed as PHP code. This chain of vulnerabilities can lead to complete compromise of the WordPress site. The weakness is classified as CWE-98, indicating improper control of file paths and inclusion. The adversary could gain full control over the web server, exfiltrate data, install backdoors, or pivot to other systems on the network.

WordPress sites that use the Ads Pro Plugin version 4.89 or earlier, specifically those developed by Scripteo. No specific upstream versions are listed; the vulnerability exists in all releases up to and including the stated 4.89 version.

The CVSS score of 9.8 classifies this flaw as critical. The EPSS score of less than 1% indicates that while the probability of exploitation is low at present, the potential damage is severe. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is an unauthenticated payload consisting of an image file upload, followed by a SQL injection to retrieve the file, and culminating in a local file inclusion that causes the server to execute the file as PHP code. The lack of authentication requirements and the remote nature of the code execution elevate the risk considerably.