What is the CVSS score of EUVD-2026-38758?

EUVD-2026-38758 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of PHP are affected by EUVD-2026-38758?

The AdRotate Banner Manager WordPress plugin contains a vulnerability that allows contributor-level staff to gain unauthorized server access and execute arbitrary code, threatening data…

How to fix or mitigate EUVD-2026-38758?

Within 24 hours: Audit WordPress user roles and disable or restrict Contributor role assignments to essential personnel only; disable W3 Total Cache or Borlabs Cache integration in AdRotate settings. Within 7 days: Disable the AdRotate Banner Manager plugin entirely or migrate to an alternative banner solution pending vendor security patch. Within 30 days: Conduct full WordPress plugin inventory, document security support status for each plugin, and implement quarterly vulnerability scanning and patch management procedures.

PHP EUVD-2026-38758

| CVE-2026-12242 HIGH

Code Injection (CWE-94)

2026-06-24 Wordfence

GHSA-5gg9-wwjm-frfp

Code Injection WordPress PHP RCE Adrotate Banner Manager

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 13:15 vuln.today

CVE Published

Jun 24, 2026 - 12:33 cve.org

HIGH 8.8

DescriptionCVE.org

The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 5.17.7 via the 'banner' attribute of the adrotate shortcode. This is due to insufficient input validation and sanitization of the banner shortcode attribute before concatenation into a PHP code string wrapped in W3 Total Cache mfunc or Borlabs Cache fragment markers. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server. This vulnerability requires W3 Total Cache or Borlabs Cache support to be enabled in AdRotate settings.

Articles & Coverage 2

News 8 New PHP Vulnerabilities - 1 Critical, 7 High, 2 With POC Jun 25, 2026 News 18 New WordPress Vulnerabilities - 2 Critical, 6 With POC Jun 25, 2026

AnalysisAI

Authenticated PHP code injection in the AdRotate Banner Manager WordPress plugin (versions ≤5.17.7) allows Contributor-level users to execute arbitrary PHP on the server by abusing the 'banner' attribute of the [adrotate] shortcode. Exploitation requires W3 Total Cache or Borlabs Cache support to be enabled in AdRotate settings, where unsanitized input is concatenated into a PHP string wrapped in mfunc/fragment cache markers. Reported by Wordfence; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.