CVE-2024-2290

The Advanced Ads plugin for WordPress through version 1.52.1 contains a PHP Object Injection vulnerability caused by unsafe deserialization of the 'placement_slug' parameter, allowing authenticated users to inject malicious PHP objects. While the plugin itself lacks a POP chain to directly exploit this flaw, the presence of a POP chain in other installed plugins or themes could enable attackers to perform actions such as arbitrary file deletion, sensitive information disclosure, or remote code execution. The vulnerability was patched in version 1.52.2.

Based on public CVE data (MITRE/NVD).