CVE-2025-4380 is a high severity (CVSS 8.1) local file inclusion flaw in the Ads Pro Plugin for WordPress, all versions up to and including 4.89. Unauthenticated attackers can include and run files on the server. The record names no fixed version, so check the vendor page and remove the plugin if you cannot update.
What's affected
The record lists the Ads Pro Plugin, a multi purpose WordPress advertising manager sold through CodeCanyon, in all versions up to and including 4.89. The flaw is in the bsa_preview_callback function, through the bsa_template parameter.
The record does not name a fixed version. Wordfence's entry and the CodeCanyon page are the two references, and I could not retrieve either one while preparing this post. Check the plugin's changelog for a release above 4.89 that mentions the file inclusion fix.
The attack is rated high complexity in the vector, which accounts for the 8.1 score rather than 9.8. The description explains why: running arbitrary PHP depends on being able to include a file that contains PHP code, for example one that was uploaded or already exists.
How to check if you're exposed
On a WordPress host with WP-CLI, run wp plugin list and look for the Ads Pro entry and its version. In the dashboard, the Plugins page shows the same.
Because the plugin is sold through a marketplace rather than the WordPress plugin directory, it may not update automatically. Check the version against the changelog from the vendor.
Review the access logs for requests that mention the preview action with a bsa_template value that does not look like a normal template name, and look for unexpected PHP files in the uploads folder. Both are signs worth escalating.
What to do now
- Find every WordPress site that has the Ads Pro plugin, including old staging copies.
- Check the vendor page for a version above 4.89 that fixes the issue, and update if one exists.
- If no fix is available, deactivate and delete the plugin, and replace the ad placements with another method.
- Block PHP execution in the uploads directory at the web server level.
- Put a web application firewall in front of the site and confirm it covers inclusion style requests.
- Check for unfamiliar administrator users and PHP files, and rotate secrets if you find any.
Why it matters
The class is improper control of filename for include, CWE-98 (PHP Remote File Inclusion). The plugin takes a value from the request and uses it to choose a file to include. If the value is not restricted to a short list of safe templates, a caller can point it at other files on the server.
Local file inclusion becomes code execution when the attacker can place PHP somewhere the server will include it. WordPress sites often allow uploads, and plugins add more upload paths, so that condition is easier to meet than it sounds.
The record does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Premium plugins sold outside the official directory can lag in updates, so keep a list of what is installed and from where.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do attackers need to log in?
No. The record says unauthenticated attackers can use the flaw, though code execution depends on being able to include a file that contains PHP.
Is there a fixed version?
The record names none. Check the vendor changelog and the Wordfence entry. If nothing newer than 4.89 exists, remove the plugin.
Sources
- Gold entry for CVE-2025-4380
- Wordfence entry referenced by the NVD record
- CodeCanyon product page referenced by the NVD record
Last reviewed: 18 October 2026.
