The Ads Pro Plugin for WordPress versions up to 4.89 contains a CSRF vulnerability due to improper nonce validation in the bsaCreateAdTemplate function. This flaw allows an attacker to craft a forged request that, if executed by an authenticated site administrator, can lead to arbitrary PHP code execution. The vulnerability does not require prior authentication but depends on social engineering to trick an admin user. The CVSS 3.1 score of 8.8 reflects the ease of exploitation (network vector, low attack complexity, no privileges required, user interaction needed) and the high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to arbitrary PHP code execution on the affected WordPress site, potentially compromising the entire system, including data confidentiality, integrity, and availability. Since the attack requires tricking a site administrator into performing an action, the risk depends on user interaction but remains high due to the severity of the impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and requests related to the Ads Pro Plugin and consider disabling or restricting access to the vulnerable functionality. Monitoring for updates from the plugin vendor or WordPress security channels is strongly recommended.