The Ads Pro Plugin – Multi‑Purpose WordPress Advertising Manager has a missing or incorrect nonce check in the bsaCreateAdTemplate function, allowing attackers to force a site administrator to click a crafted link and trigger the execution of arbitrary PHP code on the server. This flaw gives attackers full control over the affected WordPress installation and represents a high‑severity CSRF (CWE‑352).

Any WordPress site that installs the scripteo Ads Pro Plugin, version 4.89 or earlier, is vulnerable. The plugin is distributed through the WordPress ecosystem, so typical hosts running local or cloud‑based WordPress sites fall within the scope.

The vulnerability scores a CVSS of 8.8 and an EPSS of less than 1 %. It does not appear in the CISA KEV catalog. While the low EPSS indicates a modest likelihood of exploitation, the risk remains high because unauthenticated remote code execution is possible if an administrator follows an attacker‑provided link. The likely attack vector is a simple HTTP request embedded in a link that an administrator opens.