Executive brief
The AdRotate Banner Manager plugin for WordPress, which is used to manage and display advertisements, contains a security flaw that allows users with basic contributor permissions to run malicious code on the website's server. This could lead to a complete takeover of the website, theft of sensitive data, or disruption of services. The issue specifically affects sites that also use certain caching tools like W3 Total Cache or Borlabs Cache.
Technical details
The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection (CWE-94) due to insufficient input validation and sanitization of the 'banner' attribute within the [adrotate] shortcode. The vulnerable code in 'adrotate-output.php' concatenates user-supplied input into a PHP code string that is subsequently wrapped in W3 Total Cache 'mfunc' or Borlabs Cache fragment markers. An authenticated attacker with Contributor-level permissions or higher can exploit this to execute arbitrary PHP code on the underlying server. This exploit requires that either W3 Total Cache or Borlabs Cache support is enabled within the AdRotate settings. A patch appears to be available in versions following 5.17.7.
Affected products
- adegans AdRotate Banner Manager up to, and including, 5.17.7
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://plugins.trac.wordpress.org/browser/adrotate/tags/5.17.4/adrotate-output.php
- https://plugins.trac.wordpress.org/browser/adrotate/tags/5.17.4/adrotate-output.php
- https://plugins.trac.wordpress.org/browser/adrotate/tags/5.17.4/adrotate-output.php
- https://plugins.trac.wordpress.org/browser/adrotate/tags/5.17.5/adrotate-output.php
- https://plugins.trac.wordpress.org/browser/adrotate/tags/5.17.5/adrotate-output.php
- https://plugins.trac.wordpress.org/browser/adrotate/tags/5.17.5/adrotate-output.php
- https://plugins.trac.wordpress.org/browser/adrotate/trunk/adrotate-output.php