---
id: "CVE-2026-115603"
kind: "vulnerability"
aliases: ["CVE-2026-115603"]
title: "Advanced Ads Tracking WordPress plugin: blind SQL injection before 4.0.0"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["advanced-ads-tracking", "package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-28T14:16:57+00:00"
first_seen_at: "2026-10-28T14:33:22+00:00"
updated_at: "2026-10-28T14:34:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115603", "first_seen_at": "2026-10-28T14:33:22+00:00"}]
---

# Advanced Ads Tracking WordPress plugin: blind SQL injection before 4.0.0

The Advanced Ads – Tracking WordPress plugin does not neutralize input before it is placed in an SQL query, allowing blind SQL injection. An attacker can read data from the site's database one inference at a time, which can expose user records and password hashes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the `advanced-ads-tracking` plugin in the WordPress admin under Plugins, or with `wp plugin get advanced-ads-tracking --field=version`
- Note whether the version is below `4.0.0`

## Fix

- Update the Advanced Ads – Tracking plugin (`advanced-ads-tracking`) to `4.0.0` or later
- If an update is not possible, deactivate the plugin until it is patched

## Timeline

- 2026-10-28T14:33:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115603

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_