CVE-2026-115603: WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is remotely exploitable with low attack complexity, but the attacker needs low-level privileges. No user interaction is required.

Q: What are the potential security impacts?

Successful exploitation can expose highly sensitive information and can affect other security scopes beyond the vulnerable component. The availability impact is rated low, while integrity impact is rated none.

Q: Which releases are affected?

Advanced Ads – Tracking versions before 4.0.0 are affected. The available data does not identify a lower bound for affected versions.

Published Oct 28, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0.

Affected Software

1 affected component

Advanced Ads GmbH Advanced Ads – Tracking<4.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/advanced-ads-tracking to a version that resolves this vulnerability.
Fixed in 4.0.0

Event History

Oct 28, 2026

CVE Published

via MITRE·02:02 PM

Data Sourced

via MITRE·02:02 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability is remotely exploitable with low attack complexity, but the attacker needs low-level privileges. No user interaction is required.

What are the potential security impacts?