PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54816 Monetizemore CVE debrief

A high-severity vulnerability (CVSS Score: 7.5) was discovered in the Advanced Ads plugin for WordPress, affecting versions from n/a to 2.0.21. This Code Injection vulnerability allows remote attackers to include malicious code, potentially leading to Remote Code Execution (RCE). The vulnerability was publicly disclosed on June 17, 2026. Users of the affected plugin should update to version 2.0.22 or higher to mitigate the risk.

Vendor
Monetizemore
Product
Advanced Ads
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-17
Advisory published
2026-06-17
Advisory updated
2026-06-17

Who should care

WordPress administrators and users of the Advanced Ads plugin, especially those with untrusted or unauthenticated access to the plugin's functionality, should prioritize updating to a patched version.

Technical summary

The Advanced Ads plugin for WordPress is vulnerable to a Code Injection attack, which could allow an attacker to execute arbitrary code on the affected system. This vulnerability is due to improper control of code generation, making it possible for remote attackers to inject malicious code. The Common Weakness Enumeration (CWE) identifier for this vulnerability is CWE-94.

Defensive priority

High

Recommended defensive actions

  • Update the Advanced Ads plugin to version 2.0.22 or higher.
  • Restrict access to the plugin's functionality to trusted users only.
  • Implement a Web Application Firewall (WAF) to detect and prevent suspicious traffic.
  • Regularly monitor plugin and WordPress core updates.
  • Consider using a security plugin to enhance WordPress security.
  • Limit the use of plugins and keep the WordPress core up-to-date.
  • Perform regular security audits and vulnerability assessments.

Evidence notes

The vulnerability was reported by Patchstack and is publicly listed in the CVE database. The CVE record and NVD details provide additional context on the vulnerability.

Official resources

Publicly disclosed on June 17, 2026.