AdRotate Banner Manager versions up to 5.17.7 allow PHP code injection through the 'banner' attribute of the adrotate shortcode because the plugin concatenates unsanitized input into a PHP code string wrapped in fragment markers for W3 Total Cache or Borlabs Cache. This insufficient input validation permits an attacker to inject arbitrary PHP code that will be executed on the server when the shortcode is processed, thereby compromising the confidentiality, integrity, and availability of the entire WordPress site. The vulnerability is limited to authenticated users with Contributor-level access or higher on a WordPress installation that has either W3 Total Cache or Borlabs Cache support enabled in AdRotate settings. Any site that runs one of those caching plugins together with a vulnerable version of AdRotate Banner Manager exposes all files and server resources to execution of attacker-supplied PHP code. The CVSS score of 8.8 classifies this flaw as high severity, and although an EPSS score is currently unavailable, the lack of a KEV listing does not negate the risk. In a realistic scenario an attacker would need to authenticate as a Contributor, enable the relevant caching plugin, and then embed malicious PHP in the 'banner' attribute of the shortcode. This can lead to full server compromise if the injected code gains sufficient privileges.

AdRotate Banner Manager by adegans is the affected product. All releases up to and including 5.17.7 are vulnerable. The flaw resides in the adrotate shortcode implementation. WordPress sites running any 5.17.7 or older release of this plugin with W3 Total Cache or Borlabs Cache support enabled in the plugin settings are susceptible.

The flaw carries a CVSS score of 8.8, indicating a high severity. No EPSS score is available, but the lack of a KEV listing does not reduce the threat. Exploitation requires an authenticated Contributor or higher on a WordPress site with W3 Total Cache or Borlabs Cache enabled in AdRotate settings. The attacker must embed malicious PHP within the banner attribute of an adrotate shortcode. Successful exploitation results in arbitrary PHP execution on the server, enabling potential full compromise of the site and underlying systems.