What is the CVSS score of CVE-2026-54824?

CVE-2026-54824 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Ads by WPQuads are affected by CVE-2026-54824?

Ads by WPQuads, a widely-deployed WordPress plugin, contains an unauthenticated vulnerability that enables remote unauthorized access to sensitive information (CVE-2026-54824, CVSS 7.5).

How to fix or mitigate CVE-2026-54824?

Within 24 hours: Inventory all WordPress instances running Ads by WPQuads version 3.0.3 or earlier; disable or deactivate the plugin if feasible; implement Web Application Firewall rules blocking exploitation patterns; assess scope of potentially exposed sensitive data. Within 7 days: Remove the plugin entirely or replace with an alternative ad management solution; submit escalation request to Patchstack requesting expedited patch release; review access logs for indicators of exploitation. Within 30 days: Establish continuous monitoring dashboard for plugin patch status; implement organizational policy requiring removal of unpatched plugins within defined SLA; conduct full security assessment of remaining WordPress plugin inventory.

Ads by WPQuads CVE-2026-54824

EUVD-2026-39784 HIGH

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-06-26 audit@patchstack.com

GHSA-jqm5-j5fc-x67x

WordPress Information Disclosure Wordpress Plugin

7.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network read with no interaction (AV:N/AC:L/PR:N/UI:N); confidentiality set to L not H because the specific exposed data is unspecified and CWE-497 typically yields partial system/config disclosure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:32 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions.

AnalysisAI

Unauthenticated information disclosure in the Ads by WPQuads (Quick AdSense Reloaded) WordPress plugin versions 3.0.3 and earlier lets remote attackers read sensitive data without any credentials or user interaction. The flaw, reported by Patchstack and classified as CWE-497, exposes information to an unauthorized control sphere over the network. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the Ads by WPQuads plugin (WordPress slug quick-adsense-reloaded), a PHP-based advertising management plugin that injects and manages ad code within WordPress sites. The vulnerability is categorized under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), a root-cause class in which a plugin endpoint, AJAX action, or admin/config data is served to actors who should not have access - typically because an output path lacks a capability check or authentication gate. Because WordPress plugins commonly register AJAX/REST handlers that run before authorization is enforced, an unauthenticated request can reach data intended only for privileged users. The exact CPE was not supplied in the input; affected scope is expressed as the plugin at versions <= 3.0.3.

RemediationAI

No vendor-released patch version was identified in the available data; upgrade to the latest Ads by WPQuads release beyond 3.0.3 once the vendor's fixed version is confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/quick-adsense-reloaded/vulnerability/wordpress-ads-by-wpquads-plugin-3-0-3-sensitive-data-exposure-vulnerability?_s_id=cve) or the plugin's WordPress.org changelog. Until a confirmed fixed version is applied, compensating controls include restricting access to the plugin's AJAX/REST endpoints at the web server or WAF layer (Patchstack offers virtual patching for this CVE), or temporarily deactivating the Ads by WPQuads plugin if ad delivery can be paused - the trade-off being loss of ad serving and any layout dependent on it. Avoid exposing the WordPress admin and admin-ajax.php to untrusted networks where feasible, noting this may interfere with legitimate front-end AJAX features.