CVE-2026-12242

The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 5.17.7 via the 'banner' attribute of the adrotate shortcode. This is due to insufficient input validation and sanitization of the banner shortcode attribute before concatenation into a PHP code string wrapped in W3 Total Cache mfunc or Borlabs Cache fragment markers. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server. This vulnerability requires W3 Total Cache or Borlabs Cache support to be enabled in AdRotate settings.

• CWE-94

• https://plugins.trac.wordpress.org/browser/adrotate/tags/5.17.4/adrotate-output.php#L265
• https://plugins.trac.wordpress.org/browser/adrotate/tags/5.17.4/adrotate-output.php#L276
• https://plugins.trac.wordpress.org/browser/adrotate/tags/5.17.4/adrotate-output.php#L288
• https://plugins.trac.wordpress.org/browser/adrotate/tags/5.17.5/adrotate-output.php#L265
• https://plugins.trac.wordpress.org/browser/adrotate/tags/5.17.5/adrotate-output.php#L276
• https://plugins.trac.wordpress.org/browser/adrotate/tags/5.17.5/adrotate-output.php#L288
• https://plugins.trac.wordpress.org/browser/adrotate/trunk/adrotate-output.php#L265
• https://plugins.trac.wordpress.org/browser/adrotate/trunk/adrotate-output.php#L276
• https://plugins.trac.wordpress.org/browser/adrotate/trunk/adrotate-output.php#L288
• https://plugins.trac.wordpress.org/changeset/3582562/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f29b905c-57cf-4fb8-b6af-eb0c367cd3e4?source=cve

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12233The PSA Protected Storage credential backend (subsys/net/lib…5.9
• CVE-2026-12234The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z…7.8
• CVE-2026-12235The Linkable Loadable Extensions (llext) subsystem mis-handl…6.3
• CVE-2026-12238The WP Go Maps – Most Popular Map Plugin plugin for WordPres…5.3
• CVE-2026-1224Tanium addressed an uncontrolled resource consumption vulner…6.5
• CVE-2026-12240The Export User Data plugin for WordPress is vulnerable to a…8
• CVE-2026-12243NLTK version 3.9.4 is vulnerable to a path traversal attack …7.5
• CVE-2026-12244If NSD is configured as secondary for a zone, the primary of…8.8
• CVE-2026-12245NSD from version 4.13.0 has a heap use-after-free bug in log…7.5
• CVE-2026-12246NSD version 4.14.0 introduced a bug where a specially crafte…8.1
• CVE-2026-12249An issue was discovered in Canonical ADSys upstream versions…9
• CVE-2026-1225ACE vulnerability in configuration file processing by QOS.C…1.8