CVE-2025-4380

Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager, a WordPress plugin by scripteo, is vulnerable to an unauthenticated local file inclusion (CWE-98) affecting all versions up to and including 4.89. The flaw resides in the bsa_template parameter of the bsa_preview_callback function, which fails to properly restrict which files can be included, so a remote, unauthenticated attacker can supply a crafted path that causes the server to include and execute arbitrary local files. Any PHP code inside an included file runs in the web server's context, enabling attackers to bypass access controls, obtain sensitive data, and achieve code execution where attacker-controllable .php files can be uploaded or already exist on the site. Any WordPress site running the plugin at version 4.89 or earlier is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the 40.4% EPSS score (99th percentile) indicates a high likelihood of exploitation within the next 30 days.

What to do: Update the plugin to a patched release newer than version 4.89 as soon as one is available, or deactivate the plugin until the patch is applied. Since the flaw allows arbitrary file inclusion and potential code execution, check the site for unexpected .php uploads, modified files, and rogue administrator accounts, and review access logs for unauthenticated requests containing bsa_template parameters.