CVE-2026-12242 is a high-severity vulnerability (CVSS 8.8) in the AdRotate Banner Manager WordPress plugin caused by improper control of code generation (CWE-94). The vulnerability arises from inadequate sanitization of the 'banner' attribute in the adrotate shortcode, which is concatenated into PHP code wrapped in W3 Total Cache mfunc or Borlabs Cache fragment markers. This allows authenticated attackers with Contributor or higher privileges to execute arbitrary PHP code on the server, contingent on cache support being enabled in the plugin. No official patch or remediation guidance is currently available.

Successful exploitation allows authenticated users with Contributor-level access or above to execute arbitrary PHP code on the web server hosting the WordPress site. This can lead to full compromise of the server, including data theft, site defacement, or further pivoting within the network. The vulnerability requires that W3 Total Cache or Borlabs Cache support is enabled in AdRotate settings, limiting the attack surface to sites using these caching features.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling W3 Total Cache or Borlabs Cache support in AdRotate settings to mitigate the risk. Additionally, restrict Contributor-level access and above to trusted users only, as exploitation requires authenticated access with these privileges.