CVE-2025-4689 affects the Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress, versions up to and including 4.89. The vulnerability arises from improper control of filenames used in include/require statements (CWE-98), combined with a SQL Injection vulnerability and an image upload feature. Attackers can exploit the SQL Injection to reference uploaded image files, which due to the LFI vulnerability, can be executed as PHP code, resulting in remote code execution without authentication.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the affected server, leading to full compromise of the web server and potentially the underlying system. This can result in data theft, defacement, malware deployment, or further network penetration. The vulnerability is critical with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, it is recommended to disable or remove the vulnerable plugin to prevent exploitation. Monitor official vendor channels for updates and apply patches promptly once released.