{"id":"CVE-2026-115603","kind":"vulnerability","aliases":["CVE-2026-115603"],"related":[],"title":"Advanced Ads Tracking WordPress plugin: blind SQL injection before 4.0.0","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0.","summary":"The Advanced Ads – Tracking WordPress plugin does not neutralize input before it is placed in an SQL query, allowing blind SQL injection. An attacker can read data from the site's database one inference at a time, which can expose user records and password hashes.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["advanced-ads-tracking","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the `advanced-ads-tracking` plugin in the WordPress admin under Plugins, or with `wp plugin get advanced-ads-tracking --field=version`\n- Note whether the version is below `4.0.0`","fix":"- Update the Advanced Ads – Tracking plugin (`advanced-ads-tracking`) to `4.0.0` or later\n- If an update is not possible, deactivate the plugin until it is patched","status":"open","published_at":"2026-10-28T14:16:57+00:00","first_seen_at":"2026-10-28T14:33:22+00:00","triaged_at":"2026-10-28T14:34:22+00:00","updated_at":"2026-10-28T14:34:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T14:34:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Advanced Ads – Tracking plugin (`advanced-ads-tracking`) to `4.0.0` or later\n- If an update is not possible, deactivate the plugin until it is patched","reach":"internet","title":"Advanced Ads Tracking WordPress plugin: blind SQL injection before 4.0.0","impact":"high","summary":"The Advanced Ads – Tracking WordPress plugin does not neutralize input before it is placed in an SQL query, allowing blind SQL injection. An attacker can read data from the site's database one inference at a time, which can expose user records and password hashes.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","advanced-ads-tracking","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads database contents, including user and password data, via SQL queries","analyst_note":"Check the NVD entry and the plugin changelog for the exact affected range and whether authentication or a tracking setting is required.","how_to_check":"- Check the installed version of the `advanced-ads-tracking` plugin in the WordPress admin under Plugins, or with `wp plugin get advanced-ads-tracking --field=version`\n- Note whether the version is below `4.0.0`","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Advanced Ads – Tracking plugin (`advanced-ads-tracking`) below version `4.0.0` are exposed. The sources do not say whether the flaw needs a logged-in account or a specific tracking setting, so assume any reachable site with the plugin installed. Sites that do not use the plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":3336,"output_tokens":630,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115603':13A,16A '-2026':12A,15A '4.0.0':10A,110C 'ad':2A,19B,31B,89C,92C,96C,105C 'advanc':1A,18B,30B,88C,91C,95C,104C 'advanced-ads-track':17B,94C 'affect':103C 'allow':47B,98C 'attack':52B 'blind':6A,48B,99C 'command':83C 'cve':11A,14A 'data':55B 'databas':60B 'element':78C 'expos':68B 'gmbh':90C 'hash':73B 'host':24B 'improp':74C 'infer':62B 'inject':8A,50B,85C 'injection.this':101C 'input':38B 'issu':102C 'n/a':108C 'neutral':37B,75C 'one':61B 'packag':21B 'password':72B 'place':42B 'plugin':5A,28B,34B 'queri':46B 'read':54B 'record':70B 'self':23B 'self-host':22B 'site':58B 'special':77C 'sql':7A,45B,49B,82C,84C,100C 'time':65B 'track':3A,20B,32B,93C,97C,106C 'use':79C 'user':69B 'vulner':86C 'wordpress':4A,25B,27B,33B 'wordpress-plugin':26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advanced Ads – Tracking plugin (`advanced-ads-tracking`) below version `4.0.0` are exposed. The sources do not say whether the flaw needs a logged-in account or a specific tracking setting, so assume any reachable site with the plugin installed. Sites that do not use the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T14:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115603","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115603","severity":null,"published_at":"2026-10-28T14:16:57+00:00","modified_at":"2026-10-28T14:16:57+00:00","first_seen_at":"2026-10-28T14:33:22+00:00","fetched_at":"2026-10-28T14:33:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}