Live › vulnerability › CVE-2026-115603
Go to dashboardThe Advanced Ads – Tracking WordPress plugin does not neutralize input before it is placed in an SQL query, allowing blind SQL injection. An attacker can read data from the site's database one inference at a time, which can expose user records and password hashes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Sites running the Advanced Ads – Tracking plugin () below version are exposed. The sources do not say whether the flaw needs a logged-in account or a specific tracking setting, so assume any reachable site with the plugin installed. Sites that do not use the plugin can skip it.
advanced-ads-tracking4.0.0No product ranges from the sources yet.
advanced-ads-tracking plugin in the WordPress admin under Plugins, or with wp plugin get advanced-ads-tracking --field=version4.0.0advanced-ads-tracking) to 4.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115603")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.