EUVD-2026-77089
GHSA-7498-prf8-c6h3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:L because placing an order requires a registered WordPress account; I:L reflects the integrity-only business logic bypass with no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment.
AnalysisAI
Payment bypass in the Quads Ads Manager for Google AdSense WordPress plugin (versions before 3.0.5) allows any low-privilege authenticated user capable of placing an advertising order to obtain paid ad placements at no cost. The plugin fails to verify transaction completion with the configured payment gateway before updating an order's status to paid, representing a fundamental business logic failure in the purchase flow. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privilege WordPress user account with access to the plugin's ad-ordering interface - typically any registered site user if the plugin is configured for self-service ad purchases, which is its intended use case. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately captures the authentication requirement and low-complexity nature of the attack, though the raw score may understate real-world business risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Quads Ads Manager for Google AdSense plugin to version 3.0.5 or later, which enforces proper server-side verification of payment gateway transaction completion before updating order status to paid. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today