What is the CVSS score of CVE-2026-54816?

CVE-2026-54816 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Advanced Ads are affected by CVE-2026-54816?

The Monetizemore Advanced Ads WordPress plugin (versions through 2.0.21) contains a remote code execution vulnerability that requires authenticated access, affecting organizations running this…

How to fix or mitigate CVE-2026-54816?

24 hours: Audit all WordPress installations to identify Monetizemore Advanced Ads plugin deployments and document exact versions in use. 7 days: Restrict administrative access to the plugin through WordPress role-based access controls, implement Web Application Firewall rules to monitor for code injection patterns in plugin requests, and prepare a backup plan to deactivate the plugin if necessary. 30 days: Establish monitoring of Patchstack advisories and the plugin vendor's release notes; prepare and test deployment procedures for patched versions when released.

Advanced Ads CVE-2026-54816

HIGH

Code Injection (CWE-94)

2026-06-17 Patchstack

WordPress RCE Code Injection Wordpress Plugin Advanced Ads

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable WordPress plugin endpoint (AV:N); requires authenticated low-privilege account (PR:L); non-trivial conditions to trigger code injection (AC:H); PHP RCE yields full C/I/A impact within the site scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:24 vuln.today

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced Ads allows Remote Code Inclusion.

This issue affects Advanced Ads: from n/a through 2.0.21.

AnalysisAI

Remote code execution in the Monetizemore Advanced Ads WordPress plugin through version 2.0.21 allows authenticated attackers with low privileges to inject and execute arbitrary code via a code injection flaw (CWE-94). The issue was disclosed by Patchstack and carries a CVSS 3.1 base score of 7.5 (high) with high attack complexity. No public exploit identified at time of analysis.

Technical ContextAI

Advanced Ads is a widely deployed WordPress plugin developed by Monetizemore for managing and serving advertisements on WordPress sites. The vulnerability falls under CWE-94 (Improper Control of Generation of Code), meaning user-influenced input is incorporated into a code-execution context (e.g., eval, include/require, template rendering, or callable resolution) without adequate validation. The Patchstack title 'Remote Code Inclusion' further suggests the flaw enables inclusion of attacker-controlled code paths or payloads, which on WordPress typically translates into PHP code execution under the web server user account. The CPE cpe:2.3:a:monetizemore:advanced_ads:*:*:*:*:*:*:*:* covers all plugin versions up to and including 2.0.21.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data - administrators should consult the Patchstack entry at https://patchstack.com/database/wordpress/plugin/advanced-ads/vulnerability/wordpress-advanced-ads-plugin-2-0-21-remote-code-execution-rce-vulnerability and update Advanced Ads to the first version above 2.0.21 published by Monetizemore. Until that update is applied, compensating controls include deactivating the Advanced Ads plugin (will stop ad delivery and may break revenue/layout), restricting WordPress account registration and reviewing existing low-privilege accounts to eliminate the PR:L precondition, and placing the site behind a WAF with WordPress plugin rulesets (Patchstack, Wordfence) that can virtually patch the vulnerable endpoints - noting that WAF coverage may lag and can produce false positives on legitimate ad-management traffic. Restrict access to /wp-admin/admin-ajax.php and the plugin's admin endpoints to known IP ranges where feasible, accepting that this complicates legitimate editor workflows.