# CVE-2025-4689: Ads Pro Plugin - SQLi

> Live exploitation tracking for CVE-2025-4689 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-4689

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Scripteo Ads Pro Plugin
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')); CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'))
- **Tags:** wordpress, php

## Description

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server upload image files on the server than can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability.

## CrowdSec analysis

[CVE-2025-4689](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-4689) is a critical flaw in the Ads Pro Plugin for WordPress: an unauthenticated SQL injection in the `a_id` parameter can be chained with a local file inclusion and an image upload, so attackers upload a file containing PHP code, locate it through the injection and execute it, taking over the site.

CrowdSec has been tracking this vulnerability and its exploits since 26th of February 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-4689 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers hit the plugin's wp-ajax endpoint with SQL injection payloads in the `a_id` parameter, then include the uploaded file through the local file inclusion to run PHP code.

## Timeline

- 2025-07-02: CVE Published. CVE-2025-4689 is published to NVD.
- 2026-02-26: Rule Released. CrowdSec releases a rule to detect CVE-2025-4689 exploitation attempts against the CrowdSec Network.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2025-4689
- https://zeropath.com/blog/ads-pro-plugin-cve-2025-4689-rce

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-4689) follows observed exploitation activity for CVE-2025-4689. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.