CVE-2025-4380: Scripteo Ads Pro RCE Vulnerability

CVE-2025-4380 Overview

CVE-2025-4380 is a critical Local File Inclusion (LFI) vulnerability affecting the Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager for WordPress. The vulnerability exists in all versions up to and including 4.89 and allows unauthenticated attackers to include and execute arbitrary files on the server through the bsa_template parameter of the bsa_preview_callback function. Successful exploitation can lead to complete server compromise, including arbitrary PHP code execution, access control bypass, and sensitive data exfiltration.

Critical Impact

Unauthenticated attackers can achieve remote code execution on vulnerable WordPress sites by exploiting this Local File Inclusion vulnerability, potentially leading to complete site compromise.

Affected Products

• Scripteo Ads Pro Plugin for WordPress versions up to and including 4.89
• WordPress installations with the Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager

Discovery Timeline

• 2025-07-02 - CVE-2025-4380 published to NVD
• 2025-07-08 - Last updated in NVD database

Technical Details for CVE-2025-4380

Vulnerability Analysis

This Local File Inclusion vulnerability stems from improper input validation in the bsa_preview_callback function within the Ads Pro Plugin. The function accepts a user-controlled parameter called bsa_template without adequate sanitization, allowing attackers to manipulate file paths and include arbitrary files from the server's filesystem.

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which describes scenarios where user input is improperly used in PHP include or require statements. When exploited, attackers can traverse directories and include sensitive PHP files, potentially achieving code execution if they can upload malicious PHP files or leverage existing files on the system.

The network-based attack vector with no authentication requirement makes this vulnerability particularly dangerous for internet-facing WordPress installations. Attackers can exploit this remotely without any prior access to the target system.

Root Cause

The root cause of CVE-2025-4380 is insufficient input validation and sanitization of the bsa_template parameter before it is used in a file inclusion operation. The bsa_preview_callback function fails to properly validate or restrict the file paths that can be specified, allowing directory traversal sequences and arbitrary file paths to be processed.

This represents a fundamental failure to implement the principle of least privilege and input validation best practices. The function should have employed allowlisting for valid template names or strictly sanitized the input to prevent path traversal attacks.

Attack Vector

The attack vector for CVE-2025-4380 involves sending crafted HTTP requests to the vulnerable WordPress AJAX endpoint with a malicious bsa_template parameter value. Since the vulnerability is accessible without authentication, attackers can exploit it directly without requiring any credentials.

The exploitation process involves manipulating the bsa_template parameter to include path traversal sequences (such as ../) to navigate outside the intended template directory and include arbitrary PHP files. If an attacker can upload a PHP file through another mechanism (such as a file upload feature or by exploiting another vulnerability), they can then include that file through this LFI vulnerability to achieve code execution.

Even without the ability to upload files, attackers may be able to include existing sensitive files on the server, such as configuration files containing database credentials, or leverage PHP filter wrappers to read file contents or achieve code execution through log poisoning techniques.

Detection Methods for CVE-2025-4380

Indicators of Compromise

• Suspicious HTTP requests to WordPress AJAX endpoints containing the bsa_template parameter with path traversal sequences (../)
• Web server access logs showing requests to /wp-admin/admin-ajax.php with unusual bsa_preview_callback action requests
• Unexpected PHP files created in writable directories on the server
• Evidence of unauthorized file access or data exfiltration in server logs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in the bsa_template parameter
• Monitor WordPress AJAX endpoints for anomalous requests containing directory traversal sequences
• Deploy file integrity monitoring on WordPress installations to detect unauthorized file modifications
• Review web server logs for patterns consistent with LFI exploitation attempts

Monitoring Recommendations

• Enable detailed logging for all WordPress AJAX requests and regularly review for suspicious activity
• Implement real-time alerting for requests containing path traversal indicators (../, ..%2f, etc.)
• Monitor for unexpected outbound connections from the web server that could indicate successful exploitation
• Deploy endpoint detection and response (EDR) solutions to detect post-exploitation activity

How to Mitigate CVE-2025-4380

Immediate Actions Required

• Update the Ads Pro Plugin to a patched version beyond 4.89 immediately if one is available
• If no patch is available, disable or remove the Ads Pro Plugin until a security update is released
• Implement WAF rules to block requests containing path traversal sequences targeting the vulnerable endpoint
• Review server logs for evidence of prior exploitation attempts and investigate any suspicious activity

Patch Information

Organizations using the Ads Pro Plugin should check the CodeCanyon Product Page for the latest version and security updates. Additionally, the Wordfence Vulnerability Report provides detailed information about this vulnerability and remediation guidance.

Workarounds

• Temporarily disable the Ads Pro Plugin if an update is not immediately available
• Implement strict WAF rules to filter and block requests to the bsa_preview_callback AJAX action
• Restrict access to the WordPress admin-ajax.php endpoint from untrusted networks where feasible
• Apply file system permissions to limit which files PHP can include, reducing the impact of successful exploitation

# Example WAF rule concept for ModSecurity to block path traversal attempts
# Add to your ModSecurity configuration
SecRule ARGS:bsa_template "@rx \.\./" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'Blocked potential LFI attempt in Ads Pro Plugin'"