Advanced Ads – Tracking WordPress plugin: Blind SQL injection

Summary

The Tracking add-on for the WordPress plugin Advanced Ads (plugin slug advanced-ads-tracking) contains a Blind SQL Injection vulnerability in versions before 4.0.0. An attacker can use crafted requests to read, modify or delete database content, including user accounts and private data. Exploitation requires network access to the site; the CNA vector assumes a low-privilege WordPress account, which may be enough. The core Advanced Ads plugin is a separate product and is not fixed by updating it alone.

Affected

• Advanced Ads – Tracking (WordPress plugin, slug advanced-ads-tracking) before 4.0.0
• Range according to CNA record: before 4.0.0
• Discrepancy: VulDB describes the issue as up to 3.x and scores it 6.3 (Medium); the CNA scores it 8.5

Fixed in

• Version 4.0.0 (according to Patchstack and OffSeq)

Workaround

• Not needed if version 4.0.0 or later is installed.
• If an update is not possible immediately, deactivate or remove the Tracking add-on until it is patched.
• No vendor-published interim workaround found.

Exploitation

• No confirmed in-the-wild exploitation found.
• No public exploit code indexed in Metasploit or Exploit-DB as of 26 Oct 2026.
• EPSS: 0.21 % (percentile 11).
• CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
• Patchstack describes the vulnerability as high priority and expects exploitation; this is a vendor assessment, not confirmed exploitation.
• A proof of concept could appear quickly after disclosure.

Our recommendation

• Inventory all WordPress sites and check whether the Advanced Ads – Tracking add-on is installed and which version it runs.
• Update to version 4.0.0 or later, or deactivate the add-on until the update is applied.
• Review registration settings and remove unused low-privilege accounts.
• Check logs for unusual database errors or requests to tracking endpoints.
• Re-check the Patchstack and vendor advisories after the update and monitor for public proof-of-concept code.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Advanced Ads Tracking documentation wpadvancedads.com
• OffSeq Radar (threat entry) radar.offseq.com
• VulDB entry vuldb.com
• Strix CVE entry www.strix.ai
• Advanced Ads changelog (WordPress.org) wordpress.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:55.