Introduction
A flaw in the Advanced Ads WordPress plugin lets attackers execute arbitrary PHP functions without authentication. That can expose sensitive site data, and it may escalate to remote code execution. The plugin has over 100,000 active installations, so the vulnerability affects a significant portion of WordPress-powered publishers and ad-driven sites.
About Advanced Ads: Advanced Ads is a widely used ad management plugin for WordPress, maintained by monetizemore. It handles ad placement, targeting, and reporting, and it runs on over 100,000 sites. At that scale, a security flaw in this plugin reaches a large part of the WordPress ecosystem.
Technical Information
CVE-2025-10487 is a remote code execution vulnerability in all versions of the Advanced Ads WordPress plugin up to and including 2.0.12. The flaw is in the select_one() function, which the plugin exposes through an AJAX endpoint. The endpoint does not properly restrict access or check which functions a request can call, so unauthenticated users can invoke arbitrary PHP functions whose names begin with get_the_.
The root cause is missing access control and input validation on the AJAX handler. An attacker can send a crafted request to the admin-ajax.php endpoint with parameters that name the function to execute. The handler performs no nonce verification or capability check, so it processes the call whether or not the requester is logged in. Calling a function such as get_the_excerpt exposes information like excerpts from private or unpublished posts. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code), the weakness class that covers code injection and related flaws.
The referenced sources include no public code snippets or detailed PoC.
Detection Methods
The available sources give no detection signatures or code snippets for this vulnerability. Detection still comes down to proactive monitoring, log analysis, and specialized security tools, and these general strategies apply:
- Review the administrator accounts on your WordPress site regularly. An unexpected or unauthorized account may indicate a compromise.
- Check web server logs for unusual patterns, such as repeated failed login attempts, unexpected POST requests to administrative endpoints, or access to files that should not be publicly available. These anomalies can signal exploitation attempts.
- Deploy reputable security plugins and web application firewalls (WAFs) that monitor in real time and detect known attack patterns. They can alert you to potential threats, and some may offer virtual patching.
- Set up file integrity monitoring for critical files in your WordPress installation. Unexpected modifications can indicate malicious activity.
- Run automated vulnerability scans on a regular schedule to find known vulnerabilities, including those in plugins like Advanced Ads, so you can identify and mitigate risks promptly.
- Follow updates and security advisories for the Advanced Ads plugin, and apply updates promptly. Patching known vulnerabilities quickly reduces the risk of exploitation.
Affected Systems and Versions
- Product: Advanced Ads WordPress plugin
- Affected versions: All versions up to and including 2.0.12
- Vulnerable configuration: Any WordPress site with the Advanced Ads plugin version 2.0.12 or earlier installed and active
Vendor Security History
Advanced Ads has had several earlier security issues, including:
- Authenticated Stored Cross-Site Scripting (CVE-2024-3952, May 2024)
- Authenticated PHP Object Injection (CVE-2024-2290, May 2024)
- Authenticated Stored Cross-Site Scripting (CVE-2022-32776, September 2022)
- Reflected Cross-Site Scripting (March 2020)
The vendor has consistently patched reported vulnerabilities, but the repeated access control and input validation issues suggest the project still struggles with secure coding practices.
