A critical vulnerability in the Advanced Ads plugin for WordPress allows unauthenticated attackers to execute unauthorized functions, posing a severe risk to site integrity.

This flaw stems from a lack of capability checks on the AJAX endpoint, specifically within the select_one function. This allows unauthenticated attackers to invoke arbitrary functions starting with the get_the_ prefix, leading to potential information exposure and unauthorized code execution.

Successful exploitation of this vulnerability can result in the unauthorized exposure of sensitive site data and potential code execution. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant reputational damage and compromise of the underlying WordPress installation.

Immediate Action: Monitor the vendor website for the release of a security patch and update the Advanced Ads plugin to the latest version immediately upon availability.

Proactive Monitoring: Review web server access logs for unusual requests directed at AJAX endpoints, specifically looking for patterns involving the select_one function or unauthorized calls to get_the_ functions.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious requests to the WordPress AJAX interface, which may help block exploitation attempts until a vendor patch is applied.

Public Exploit Available: Unknown

The severity of this flaw necessitates immediate attention from security administrators. Because the vulnerability allows unauthenticated access, the risk to the application is significant. We recommend disabling the plugin if it is not business-critical until a verified security update is provided by the vendor.