CVE-2025-6459: Scripteo Ads Pro CSRF Vulnerability

CVE-2025-6459 Overview

CVE-2025-6459 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager for WordPress in all versions up to and including 4.89. The vulnerability stems from missing or incorrect nonce validation on the bsaCreateAdTemplate function, which allows unauthenticated attackers to inject and execute arbitrary PHP code through a forged request if they can trick a site administrator into clicking a malicious link.

Critical Impact

This vulnerability enables unauthenticated attackers to achieve arbitrary PHP code execution on vulnerable WordPress installations through social engineering, potentially leading to complete site compromise including data theft, malware injection, and persistent backdoor access.

Affected Products

• Scripteo Ads Pro Plugin for WordPress versions ≤ 4.89
• WordPress installations running vulnerable versions of Ads Pro Plugin

Discovery Timeline

• 2025-07-02 - CVE-2025-6459 published to NVD
• 2025-07-08 - Last updated in NVD database

Technical Details for CVE-2025-6459

Vulnerability Analysis

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw that enables remote code execution through a chained attack. The core issue lies in the bsaCreateAdTemplate function within the Ads Pro Plugin, which fails to properly validate nonce tokens before processing requests. Nonce validation is a critical WordPress security mechanism designed to prevent unauthorized actions by verifying that requests originate from legitimate sources within the WordPress admin interface.

Without proper nonce validation, the function processes requests without verifying their authenticity. When combined with the function's ability to handle template creation that includes PHP code, attackers can craft malicious requests that inject arbitrary PHP code into the WordPress installation. The attack requires user interaction—specifically, an authenticated administrator must be tricked into triggering the malicious request, typically by clicking a specially crafted link or visiting a malicious webpage while logged into their WordPress dashboard.

Root Cause

The root cause of CVE-2025-6459 is the missing or incorrect implementation of WordPress nonce validation in the bsaCreateAdTemplate function. WordPress nonces are unique tokens that should be generated and verified for any action that modifies data or performs sensitive operations. The absence of this validation mechanism means the function cannot distinguish between legitimate requests initiated by the administrator and forged requests crafted by an attacker. This security gap violates the principle of defense in depth and WordPress security best practices, which mandate nonce verification for all state-changing operations in plugin development.

Attack Vector

The attack vector for this vulnerability is network-based and requires user interaction. An attacker would craft a malicious webpage or email containing a hidden form or JavaScript that, when triggered by an authenticated WordPress administrator, sends a forged request to the vulnerable bsaCreateAdTemplate endpoint. Since the function lacks proper nonce validation, it processes the request as if it were legitimate, allowing the attacker's payload—typically malicious PHP code—to be injected and subsequently executed on the server.

The attack flow involves identifying a WordPress site running a vulnerable version of the Ads Pro Plugin, crafting a malicious payload that exploits the bsaCreateAdTemplate function to inject PHP code, delivering the payload through social engineering (phishing emails, malicious advertisements, or compromised websites), and finally the payload executing when an authenticated administrator triggers the forged request. For additional technical details, see the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-6459

Indicators of Compromise

• Unexpected or unauthorized ad templates created in the Ads Pro Plugin administration interface
• Unusual PHP files appearing in WordPress directories, particularly within plugin or theme folders
• Web server access logs showing POST requests to Ads Pro Plugin endpoints from external referrers
• Modified plugin files containing unfamiliar PHP code blocks or obfuscated content
• Administrator account activity during times the legitimate administrator was not active

Detection Strategies

• Monitor WordPress admin action logs for bsaCreateAdTemplate function calls that lack corresponding nonce validation entries
• Implement file integrity monitoring on WordPress plugin directories to detect unauthorized modifications
• Review web application firewall (WAF) logs for suspicious POST requests targeting the Ads Pro Plugin endpoints
• Configure alerts for PHP file creation or modification events within the WordPress installation directory

Monitoring Recommendations

• Enable comprehensive WordPress activity logging using security plugins to track all administrative actions
• Implement real-time file change detection for critical WordPress directories including wp-content/plugins/
• Monitor outbound network connections from the web server for potential command-and-control traffic
• Regularly audit installed plugins and their versions against known vulnerability databases

How to Mitigate CVE-2025-6459

Immediate Actions Required

• Update the Ads Pro Plugin to a version newer than 4.89 that includes proper nonce validation
• Audit existing ad templates for any suspicious or unauthorized entries
• Review WordPress user accounts and remove any unauthorized administrator accounts
• Scan the WordPress installation for malware or backdoors using reputable security tools
• Implement a Web Application Firewall (WAF) to help block CSRF attacks

Patch Information

Organizations should update the Ads Pro Plugin to the latest available version that addresses this vulnerability. The fix involves implementing proper nonce validation on the bsaCreateAdTemplate function to ensure requests are legitimate and originate from authenticated administrative sessions. Plugin updates can be obtained through the Codecanyon marketplace where the plugin is distributed.

Workarounds

• Temporarily disable the Ads Pro Plugin if an immediate update is not possible
• Implement strict Content Security Policy (CSP) headers to mitigate CSRF attack vectors
• Configure the web server to reject requests with external or missing referrer headers to plugin endpoints
• Limit WordPress administrator access to trusted IP addresses using .htaccess or firewall rules
• Educate administrators about phishing risks and the importance of not clicking untrusted links while logged into WordPress

# Apache .htaccess configuration to restrict admin access by IP
<Files "admin-ajax.php">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>