CVE-2025-4689: Scripteo Ads Pro RCE Vulnerability

CVE-2025-4689 Overview

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress contains a critical vulnerability chain that enables unauthenticated Remote Code Execution (RCE). This vulnerability exists in all versions up to and including 4.89 and combines SQL Injection with Local File Inclusion (LFI), allowing attackers to upload malicious image files, retrieve them via SQL injection, and ultimately execute arbitrary PHP code through the LFI vulnerability.

Critical Impact

Unauthenticated attackers can achieve complete server compromise by chaining SQL Injection, file upload, and Local File Inclusion vulnerabilities to execute arbitrary code on vulnerable WordPress installations.

Affected Products

• Scripteo Ads Pro Plugin versions up to and including 4.89
• WordPress installations running vulnerable Ads Pro Plugin versions
• Any server hosting affected WordPress deployments

Discovery Timeline

• 2025-07-02 - CVE-2025-4689 published to NVD
• 2025-07-08 - Last updated in NVD database

Technical Details for CVE-2025-4689

Vulnerability Analysis

This vulnerability represents a sophisticated attack chain that combines multiple weaknesses to achieve Remote Code Execution. The Ads Pro Plugin contains both SQL Injection and Local File Inclusion vulnerabilities that, when exploited together with the plugin's image upload functionality, allow complete server compromise.

The attack flow begins with an attacker uploading a malicious image file that contains embedded PHP code. This file passes through the plugin's upload mechanism, which fails to properly sanitize or validate the content. The attacker then leverages the SQL Injection vulnerability to retrieve the path of the uploaded file. Finally, the Local File Inclusion vulnerability is exploited to include and execute the malicious PHP code embedded within the uploaded image file.

What makes this vulnerability particularly dangerous is that all three components—file upload, SQL injection, and LFI—are accessible without authentication. This means any external attacker can exploit this vulnerability chain without needing valid credentials.

Root Cause

The root cause of CVE-2025-4689 stems from CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. The plugin fails to implement proper input validation and sanitization across multiple components. The SQL Injection vulnerability exists due to improper parameterization of database queries, while the Local File Inclusion occurs because user-supplied input is used directly in PHP include statements without adequate path validation or restriction. Combined with insufficient file upload validation that allows PHP code within image files, these weaknesses create a complete RCE attack chain.

Attack Vector

The attack is network-accessible and requires no authentication, privileges, or user interaction. An attacker can exploit this vulnerability remotely by:

1. Uploading a crafted image file containing embedded PHP code through the plugin's upload functionality
2. Using SQL injection to query the database and retrieve the stored file path
3. Triggering the Local File Inclusion vulnerability by manipulating input parameters to include the uploaded malicious file
4. Achieving arbitrary code execution when the PHP interpreter processes the included file

The vulnerability mechanism relies on the plugin's failure to properly segregate and validate file paths used in include statements. When user-controlled input reaches PHP's include() or require() functions without proper sanitization, attackers can manipulate the path to include arbitrary local files, including their previously uploaded malicious content. For detailed technical analysis, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-4689

Indicators of Compromise

• Unusual image files in WordPress upload directories containing PHP code patterns such as <?php, eval(, or base64_decode(
• Database query logs showing SQL injection patterns targeting Ads Pro Plugin tables
• Web server access logs with suspicious requests to plugin endpoints containing path traversal sequences (../) or null bytes
• Unexpected PHP files or modified existing files in the WordPress installation directory
• Outbound network connections from the web server to unknown external hosts

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect SQL injection patterns and LFI traversal attempts targeting WordPress plugins
• Implement file integrity monitoring on WordPress core files, plugin directories, and upload folders
• Monitor web server logs for requests containing path manipulation characters targeting /wp-content/plugins/developer-developer-developer/
• Use endpoint detection solutions to identify unauthorized PHP process execution or suspicious child processes spawned by the web server

Monitoring Recommendations

• Enable verbose logging for WordPress and the web server to capture detailed request information
• Set up alerts for new file creation or modification within WordPress directories outside of expected update windows
• Monitor database query logs for abnormal query patterns or errors that may indicate SQL injection attempts
• Implement network traffic analysis to detect command-and-control communication from compromised servers

How to Mitigate CVE-2025-4689

Immediate Actions Required

• Audit WordPress installations to identify if Ads Pro Plugin version 4.89 or earlier is installed
• Consider temporarily disabling or removing the Ads Pro Plugin until a patched version is available
• Implement Web Application Firewall rules to block SQL injection and path traversal attempts
• Review server logs for any indication of exploitation attempts or successful compromise
• Restrict file upload capabilities and implement strict file type validation at the server level

Patch Information

Organizations using the Ads Pro Plugin should monitor for updates from the vendor. Check the CodeCanyon Product Listing for the latest version information and update announcements. Until a patch is released, implement the workarounds described below to reduce exposure.

Workarounds

• Implement strict WAF rules blocking SQL injection payloads and path traversal sequences in requests to the plugin
• Disable the image upload functionality in the Ads Pro Plugin if not business-critical
• Apply PHP configuration hardening by setting open_basedir to restrict file access to the WordPress directory tree only
• Use disable_functions in php.ini to block dangerous functions like exec, system, passthru, and shell_exec
• Consider placing the WordPress site behind authentication or IP-based access controls if public access is not required

# PHP configuration hardening example
# Add to php.ini or .htaccess

# Restrict PHP file operations to WordPress directory only
open_basedir = /var/www/html/wordpress/:/tmp/

# Disable dangerous PHP functions
disable_functions = exec,passthru,shell_exec,system,proc_open,popen,parse_ini_file,show_source

# Additional hardening
allow_url_include = Off
allow_url_fopen = Off