Advanced Ads CVE-2025-13592

Exploitation requires an authenticated WordPress account with editor-level capabilities or higher (PR:H), and the attacker must be able to create or edit an Advanced Ads 'plain text' ad so that attacker-controlled input reaches the 'change-ad__content' shortcode parameter, which is evaluated as PHP by includes/ads/class-ad-plain.php. There is no user-interaction requirement and no non-default configuration needed beyond having the Advanced Ads plugin (<=2.0.14) installed and the attacker possessing the editor+ role. The principal limiting factor is the privilege prerequisite: unprivileged or unauthenticated users and subscriber/author/contributor roles below editor cannot reach the vulnerable sink, so risk concentrates on sites that grant editor accounts to semi-trusted users.

This is a genuine high-severity flaw but with a meaningful barrier to exploitation that moderates its real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) correctly reflects network-reachable, low-complexity code execution with full confidentiality/integrity/availability impact, consistent with CWE-94 code injection yielding server-side RCE. The decisive mitigating signal is PR:H: per Wordfence and the description, exploitation requires an authenticated account at editor-level or above, so this is not an anonymous internet-facing bug but a privilege-escalation-to-RCE path usable by a trusted-but-not-admin user (or an attacker who has phished/compromised an editor account). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization at this time. The practical priority is high for multi-author or membership WordPress sites where editor accounts are widely provisioned, and lower for single-admin sites where editor == effectively trusted. No signals conflict here; the main gap is the absence of EPSS and exploitation telemetry, so risk is inferred from the CVSS vector and privilege model rather than observed exploitation.

An attacker who holds or has compromised a WordPress editor-level account inserts a malicious payload into the 'change-ad__content' shortcode parameter of an Advanced Ads 'plain text' ad, which is then evaluated as PHP on the server, yielding arbitrary code execution. Because the attack vector is network-based and low-complexity, the request can be issued directly through the normal authenticated admin/editing interface without special tooling. No public proof-of-concept was identified in the provided data.