CVE-2025-6459

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6459", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-20T20:58:22.123Z", "datePublished": "2025-07-02T03:47:22.333Z", "dateUpdated": "2026-04-08T16:41:50.309Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:50.309Z"}, "affected": [{"vendor": "scripteo", "product": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.89", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.89. This is due to missing or incorrect nonce validation on the bsaCreateAdTemplate function. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplate", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/22fa8290-ebab-4fa4-bcba-0053c3b79f76?source=cve"}, {"url": "https://codecanyon.net/item/ads-pro-plugin-multipurpose-wordpress-advertising-manager/10275010"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Tr\u01b0\u01a1ng H\u1eefu Ph\u00fac (truonghuuphuc)"}], "timeline": [{"time": "2025-07-01T14:53:53.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-02T13:01:07.865872Z", "id": "CVE-2025-6459", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-02T13:18:58.816Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6459", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-02T13:01:07.865872Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-02T13:05:25.743Z"}}], "cna": {"title": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplate", "credits": [{"lang": "en", "type": "finder", "value": "Tr\u01b0\u01a1ng H\u1eefu Ph\u00fac (truonghuuphuc)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "scripteo", "product": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.89"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-01T14:53:53.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/22fa8290-ebab-4fa4-bcba-0053c3b79f76?source=cve"}, {"url": "https://codecanyon.net/item/ads-pro-plugin-multipurpose-wordpress-advertising-manager/10275010"}], "descriptions": [{"lang": "en", "value": "The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.89. This is due to missing or incorrect nonce validation on the bsaCreateAdTemplate function. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-07-02T03:47:22.333Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6459", "state": "PUBLISHED", "dateUpdated": "2025-07-02T13:18:58.816Z", "dateReserved": "2025-06-20T20:58:22.123Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-02T03:47:22.333Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager", "vendor": "scripteo", "versions": [{"lessThanOrEqual": "4.89", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:scripteo:ads_pro:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "1F5A3BA9-1E6E-4BE0-B4BA-F69EC84C4BF5", "versionEndIncluding": "4.89", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.89. This is due to missing or incorrect nonce validation on the bsaCreateAdTemplate function. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Ads Pro Plugin - Multi-Purpose WordPress Advertising Manage de WordPress, es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 4.89 (incluida). Esto se debe a la falta o a una validaci\u00f3n incorrecta de nonce en la funci\u00f3n bsaCreateAdTemplate. Esto permite que atacantes no autenticados inyecten y ejecuten c\u00f3digo PHP arbitrario mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-6459", "lastModified": "2026-06-17T10:01:56.387", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6459", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-02T13:01:07.865872Z", "version": "2.0.3"}}]}, "published": "2025-07-02T04:15:59.413", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://codecanyon.net/item/ads-pro-plugin-multipurpose-wordpress-advertising-manager/10275010"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/22fa8290-ebab-4fa4-bcba-0053c3b79f76?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T11:08:29.679244+00:00", "value": {"mitigation_remediation": ["Install the latest Ads Pro Plugin version released after 4.89 that resolves the CSRF flaw.", "If an update is not available or cannot be applied, deactivate or uninstall the plugin, or strip the bsaCreateAdTemplate endpoint by adding a custom snippet that hooks into WordPress.", "After applying the fix or removal, audit administrator accounts and enforce strong permissions with a security plugin that limits ad-creation rights to trusted users."], "summary": {"action": "Update", "impact": "Remote Code Execution via PHP Injection"}, "threat_synthesis": {"affected_systems": "Any WordPress site that installs the scripteo Ads Pro Plugin, version 4.89 or earlier, is vulnerable. The plugin is distributed through the WordPress ecosystem, so typical hosts running local or cloud\u2011based WordPress sites fall within the scope.", "description_and_impact": "The Ads Pro Plugin \u2013 Multi\u2011Purpose WordPress Advertising Manager has a missing or incorrect nonce check in the bsaCreateAdTemplate function, allowing attackers to force a site administrator to click a crafted link and trigger the execution of arbitrary PHP code on the server. This flaw gives attackers full control over the affected WordPress installation and represents a high\u2011severity CSRF (CWE\u2011352).", "risk_and_exploitability": "The vulnerability scores a CVSS of 8.8 and an EPSS of less than 1\u202f%. It does not appear in the CISA KEV catalog. While the low EPSS indicates a modest likelihood of exploitation, the risk remains high because unauthenticated remote code execution is possible if an administrator follows an attacker\u2011provided link. The likely attack vector is a simple HTTP request embedded in a link that an administrator opens."}}}}, "created": "2026-04-28T11:15:26.095293+00:00", "updated": "2026-04-28T11:15:26.095306+00:00", "vendors": []}