CVE-2022-0661
📋 TL;DR
The Ad Injection WordPress plugin through version 1.2.0.19 contains a critical vulnerability that allows authenticated administrators to inject arbitrary HTML, JavaScript, and PHP code into website pages. This enables stored cross-site scripting (XSS) attacks and remote code execution (RCE), even when WordPress security constants like DISALLOW_FILE_EDIT are enabled. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Ad Injection WordPress Plugin
📦 What is this software?
Ad Injection by Ad Injection Project
⚠️ Risk & Real-World Impact
Worst Case
Full site compromise with attacker gaining complete control over the WordPress installation, data theft, malware distribution, and potential server-level access.
Likely Case
Site defacement, credential theft via XSS, backdoor installation, and data exfiltration.
If Mitigated
Limited impact if proper access controls and monitoring are in place, but still significant risk due to admin-level exploitation.
🎯 Exploit Status
Exploitation requires admin credentials but is straightforward once authenticated. The vulnerability is well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.0.20 or later
Vendor Advisory: https://wpscan.com/vulnerability/3c5a7b03-d4c3-46b9-af65-fb50e58b0bfd
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Ad Injection' plugin. 4. Click 'Update Now' if update available. 5. If no update available, deactivate and delete the plugin immediately.
🔧 Temporary Workarounds
Remove vulnerable plugin
linuxCompletely remove the Ad Injection plugin from your WordPress installation
rm -rf /path/to/wordpress/wp-content/plugins/ad-injection/
Restrict admin access
allTemporarily restrict administrative access to only essential personnel
🧯 If You Can't Patch
- Immediately deactivate and remove the Ad Injection plugin from all WordPress installations
- Implement strict monitoring of admin user activities and file modifications
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Ad Injection version 1.2.0.19 or earlierCheck Version:
grep -r "Version:" /path/to/wordpress/wp-content/plugins/ad-injection/ | head -1Verify Fix Applied:
Verify Ad Injection plugin version is 1.2.0.20 or later, or confirm plugin is completely removed📡 Detection & Monitoring
Log Indicators:
- Unusual admin user activity modifying ad injection settings
- Unexpected file modifications in wp-content/plugins/ad-injection/ directory
- PHP execution attempts from ad injection functionality
Network Indicators:
- Outbound connections from WordPress server to suspicious domains following admin panel access
- Unusual POST requests to ad injection endpoints
SIEM Query:
source="wordpress.log" AND ("ad-injection" OR "ad_injection") AND (admin_user="*" AND action="*edit*" OR "*update*")