CVE-2025-4380 is a Local File Inclusion (LFI) vulnerability in the Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress. It affects all versions up to and including 4.89. The vulnerability arises from improper control of the filename used in an include/require statement via the 'bsa_template' parameter in the bsa_preview_callback function. This flaw allows unauthenticated attackers to include arbitrary files on the server, which can lead to execution of arbitrary PHP code if attacker-controlled or existing PHP files are included. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector and no privileges or user interaction required.

Successful exploitation can result in remote code execution on the affected server, bypass of access controls, and disclosure of sensitive information. Because the vulnerability allows inclusion of arbitrary files, attackers can execute PHP code contained in those files, which can compromise the entire web server environment. The vulnerability is exploitable remotely without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the vulnerable functionality, disable or remove the Ads Pro Plugin if not essential, and monitor for suspicious activity related to file inclusion attempts. Avoid uploading untrusted PHP files to the server and ensure proper file permissions to limit impact.