CVE-2025-4689: 
WordPress vulnerability analysis and mitigation

CVE-2025-4689 is a critical vulnerability in the Ads Pro Plugin – Multi-Purpose WordPress Advertising Manager for WordPress that enables unauthenticated remote code execution (RCE) via a chained SQL Injection and Local File Inclusion (LFI) attack. All versions up to and including 4.89 are affected. The vulnerability was published on July 2, 2025, and was discovered and reported by Wordfence. It carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, Red Hat CVE).

The vulnerability is rooted in two chained weaknesses: CWE-89 (SQL Injection) and CWE-98 (Improper Control of Filename for Include/Require Statement in PHP – PHP Remote File Inclusion/LFI). An unauthenticated attacker can first upload a malicious image file (containing embedded PHP code) to the server, then leverage the SQL injection vulnerability to retrieve the path of the uploaded file, and finally trigger the Local File Inclusion vulnerability to execute the uploaded file as PHP code. No authentication or user interaction is required, and attack complexity is low, making this trivially exploitable over the network (Wordfence, ENISA EUVD).

Successful exploitation grants an unauthenticated remote attacker full code execution on the underlying WordPress server, resulting in complete compromise of confidentiality, integrity, and availability. An attacker can access, modify, or delete sensitive site data, install backdoors or web shells, deface the site, and potentially pivot to other systems on the same network infrastructure. The scope of impact is limited to the affected server but the severity is maximal given the lack of any authentication requirement (Wordfence, Red Hat CVE).

As of the time of publication, there is no public proof-of-concept (PoC) exploit code and no confirmed evidence of in-the-wild exploitation (Wordfence). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.203%, indicating a currently low (but non-negligible) probability of exploitation in the near term. No threat actor attribution has been reported (ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Ads Pro Plugin (versions ≤ 4.89) using tools like WPScan, Shodan, or by inspecting plugin directories (/wp-content/plugins/ads-pro/).
2. Upload malicious file: Send an unauthenticated HTTP request to the plugin's file upload endpoint, submitting a crafted image file (e.g., a .jpg or .png) with embedded PHP code (e.g., <?php system($_GET['cmd']); ?>) that bypasses file type validation.
3. Retrieve file path via SQL Injection: Craft a malicious SQL injection payload targeting a vulnerable plugin parameter or endpoint to query the database for the stored path of the uploaded file.
4. Trigger Local File Inclusion: Send a crafted request to the LFI-vulnerable endpoint, supplying the retrieved file path as the include parameter, causing the server to include and execute the uploaded file as PHP code.
5. Achieve RCE: The embedded PHP payload executes on the server, enabling arbitrary command execution, reverse shell establishment, data exfiltration, or web shell deployment (Wordfence, ENISA EUVD).

• Network: Unusual unauthenticated POST requests to Ads Pro Plugin upload endpoints; HTTP requests with SQL injection patterns (e.g., UNION SELECT, SLEEP(), encoded SQL syntax) in plugin-related parameters; outbound connections from the web server to unknown external IPs.
• File System: Unexpected PHP files or files with double extensions (e.g., shell.php.jpg) in WordPress upload directories (/wp-content/uploads/); newly created web shells or backdoor scripts in plugin or upload directories.
• Logs: WordPress or web server access logs showing repeated requests to Ads Pro Plugin endpoints with anomalous parameter values; PHP error logs referencing unexpected file inclusions or include()/require() calls with user-supplied paths.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) indicating command execution via the web shell.

The primary remediation is to update the Ads Pro Plugin to a version newer than 4.89 as soon as a patched release is available from the vendor (Scripteo). If an immediate update is not possible, administrators should disable the plugin temporarily to eliminate the attack surface. Additional interim mitigations include deploying a Web Application Firewall (WAF) with rules targeting SQL injection and LFI patterns, restricting file upload permissions and enforcing strict file type validation at the server level, and monitoring server and WordPress logs for suspicious upload and file inclusion activity. Ensure all other WordPress core files and plugins are also kept up to date (Wordfence, ENISA EUVD).

Wordfence, the discovering and reporting organization, included CVE-2025-4689 in their weekly WordPress vulnerability report for the period of June 30 – July 6, 2025, highlighting it as a critical finding (Wordfence Blog). The vulnerability was also noted on the InfoSec Exchange Mastodon community shortly after disclosure. No significant vendor statements from Scripteo or broader media coverage have been identified at this time.