Local File Inclusion Vulnerability in Ads Pro Plugin for WordPress
CVE-2025-4689
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 2 July 2025
What is CVE-2025-4689?
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager is susceptible to a Local File Inclusion vulnerability, allowing unauthenticated attackers to execute arbitrary code on the server. This vulnerability arises due to a combination of a SQL Injection flaw and Local File Inclusion tied to image file uploads. Attackers can exploit this weakness by uploading malicious files, which can subsequently be retrieved via SQL injection and executed as PHP code through the Local File Inclusion vulnerability.
Affected Version(s)
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager * <= 4.89