Executive brief
Quads is a WordPress plugin that manages Google AdSense integration and allows sites to sell ad placements to third parties. The plugin fails to verify payment completion with payment gateways before marking ad orders as paid, allowing attackers to purchase ad placements without actually paying. An attacker can register an account, place an order, and directly access the payment success URL to mark the order as paid without any actual transaction.
Technical details
The vulnerability is a payment verification bypass in the ad-selling order workflow. When a user places an ad purchase order, the plugin generates a success URL containing an order ID and security nonce. However, the plugin does not validate with the actual payment gateway (Stripe, Paystack, or Authorize.net) that payment was completed before accepting the success callback; instead, simply accessing the success URL with a valid nonce flips the order status from pending to paid. The attack is network-accessible and requires no authentication beyond creating a free subscriber account. An attacker can obtain paid ad placements indefinitely without payment. The vulnerability was fixed in version 3.0.5.
Affected products
- Automattic Quads Ads Manager for Google AdSense before 3.0.5
Timeline
- 2026-09-11: disclosed
- 2026-09-13: published
- 2026-09-11: patched: Fixed in version 3.0.5