Description
WordPress ads pro广告管理器插件4.89版本存在本地文件包含漏洞，通过“bsa_preview_callback”函数的“bsa_template”参数容易受到本地文件包含的影响。这使得未经身份验证的攻击者可以在服务器上包含和执行任意文件，从而允许执行这些文件中的任何PHP 代码。
WordPress-ads-pro 存在本地文件包含漏洞（CVE-2025-4380）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-4380
https://blog.csdn.net/weixin_50860267/article/details/142435591
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ap-plugin-scripteo/ads-pro-plugin-multi-purpose-wordpress-advertising-manager-489-unauthenticated-local-file-inclusion
https://github.com/advisories/GHSA-635h-h9cr-wcq9
https://cloud.projectdiscovery.io/library/CVE-2025-4380
https://www.ameeba.com/blog/cve-2025-4380-critical-local-file-inclusion-vulnerability-in-ads-pro-plugin-for-wordpress/
https://hackhalt.com/threat/cve-2025-4380/
https://www.sentinelone.com/vulnerability-database/cve-2025-4380/
https://advisories.checkpoint.com/defense/advisories/public/2025/cpai-2025-0695.html/
https://s4e.io/tools/ads-pro-plugin-local-file-inclusion-cve-2025-4380