Ads Pro Plugin - SQLi (CVE-2025-4689)
Description
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server upload image files on the server than can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability.
psychologyCrowdSec Analysis
CVE-2025-4689 is a critical flaw in the Ads Pro Plugin for WordPress: an unauthenticated SQL injection in the a_id parameter can be chained with a local file inclusion and an image upload, so attackers upload a file containing PHP code, locate it through the injection and execute it, taking over the site.
CrowdSec has been tracking this vulnerability and its exploits since 26th of February 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-4689 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers hit the plugin's wp-ajax endpoint with SQL injection payloads in the a_id parameter, then include the uploaded file through the local file inclusion to run PHP code.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-07-02 |
| Rule Released | 2026-02-26 |
Related Weaknesses
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.