CVE-2026-54816: WordPress Advanced Ads plugin <= 2.0.21 - Remote Code Execution (RCE) vulnerability

Synopsis

A code injection vulnerability in the Monetizemore Advanced Ads WordPress plugin (versions up to and including 2.0.21) allows a remote attacker to include and execute arbitrary code on the server. The vulnerability is reachable over the network, requires a low-privilege account, and involves high attack complexity due to environmental preconditions the attacker must meet. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system, enabling remote code execution. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable WordPress service over the network; over-the-network exposure is required to trigger the code injection endpoint.

• AuthenticationRequired

  A low-privilege WordPress account is sufficient; the attacker does not need administrative credentials, but unauthenticated access alone is not enough.

• Victim interactionNot required

  No victim interaction is needed; the attacker can trigger exploitation directly without any user clicking a link or performing an action.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must meet specific environmental or configuration conditions beyond simply sending a request, such as particular server settings or race-condition-like prerequisites.

Blast Radius

• Reads any file readable by the web server process, including WordPress configuration files containing database credentials and secret keys.
• Modifies or deletes files on the server, including plugin files, themes, and uploaded content.
• Executes arbitrary operating system commands, enabling the attacker to establish persistent access or pivot to other systems on the same network.
• Crashes or degrades the affected WordPress service by corrupting runtime state or exhausting server resources.