WordPress Ad Inserter Plugin < 2.4.22 Remote Code Execution Vulnerability

The Wordpress plugin Ad Inserter is prone to an authenticated remote code execution vulnerability.

The vulnerability stems from the use of the check_admin_referer() for authorization, when it was specifically designed to protect WordPress sites against cross-site request forgery (CSRF) exploits using nonces - one-time tokens used for blocking expired and repeated requests. Authenticated attackers who get their hands on a nonce can bypass the authorization checks powered by the check_admin_referer() function to access the debug mode provided by the Ad Inserter plugin. Once the attacker has a nonce at his disposal, he can immediately trigger the debugging feature and, even more dangerous, exploit the ad preview feature by sending a malicious payload containing arbitrary PHP code.

WordPress Ad Inserter plugin before version 2.4.22.

Update to version 2.4.22 or later.