Advanced Ads WordPress Plugin Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Advanced Ads plugin for WordPress, affecting versions through 2.0.14. The issue arises from the 'change-ad__content' shortcode parameter, allowing authenticated attackers with editor-level permissions or higher to execute arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the affected WordPress site is hosted.

Reproduction

To reproduce this vulnerability, an authenticated user with editor-level permissions or higher can use the 'change-ad__content' shortcode parameter to inject and execute PHP code on the server.

Remediation

Users are advised to update the Advanced Ads plugin to version 2.0.15 or later.