Simple Ads Manager < 2.9.4.116 — Denial of Service
964601d5-8460-41c5-9791-ff9e3af964e3Published · Updated Action summary
Affected: <2.9.4.116Update to 2.9.4.116 or newer
All remediation steps- Severity
- High7.5
- CVSS
- 7.5CVSS 3.1 · CNA (Wordfence)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWhat does this vector mean?
AV:NAttack vector- Network
AC:LAttack complexity- Low
PR:NPrivileges required- None
UI:NUser interaction- None
S:UScope- Unchanged
C:NConfidentiality- None
I:NIntegrity- None
A:HAvailability- High
- Required access
- No account needed
- Exploit prediction (EPSS)
- No score
- CISA KEV
- Not listed
On this page8
Am I affected?
Simple Ads Manager simple-ads-manager
- Affected< 2.9.4.116
- Patched in2.9.4.116
Update to 2.9.4.116 or newer.
You are affected if you run < 2.9.4.116. Version 2.9.4.116 and later are not affected by this issue.
- Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Simple Ads Manager.
- No admin access? Run a passive check of your site. It reads public files only.
- No account is needed to exploit this. Treat any exposed site on an affected version as at risk.
What to do
- Update to version 2.9.4.116, or a newer patched version
- Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
- Watch Simple Ads Manager to get an email when the next vulnerability is published.
Advisory
Source description from Wordfence Intelligence, credited to Michael Kapfer.
The Simple Ads Manager Plugin for WordPress is vulnerable to Denial of Service in versions before 2.9.4.116. This is due to an input validation flaw that allows an attacker to perform simple file system operations which can result in a denial of service. This makes it possible for unauthenticated attackers to affected website to consume memory and CPU resources, thus denying service to legitimate users.
Exploits & references
Proof-of-concept & detection
No public proof-of-concept or detection template is known for this vulnerability.
Advisories & patches
- Advisorywordfence.com
Related CVEs
More in Simple Ads Manager
All 7| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.3 | Unauthenticated PHP Objection Injection <2.10.0.130Update to 2.10.0.130 | — | |
| High8.8 | Local/Remote File Inclusion ≤2.10.0.130No patch available | — | |
| Critical9.8 | SQL Injection <2.9.5.118Update to 2.9.5.118 | — | |
| Critical10.0 | Multiple SQL Injections <2.7.97Update to 2.7.97 | CVE-2015-2824 | |
| Medium5.3 | Information Disclosure ≤2.5.96Update to 2.5.97 | CVE-2015-2826 |
- High8.3Unauthenticated PHP Objection Injection
<2.10.0.130Update to 2.10.0.130
- High8.8Local/Remote File Inclusion
≤2.10.0.130No patch available
- Critical9.8SQL Injection
<2.9.5.118Update to 2.9.5.118
- Critical10.0Multiple SQL Injections
<2.7.97Update to 2.7.97
- Medium5.3Information Disclosure
≤2.5.96Update to 2.5.97
Timeline
CVE published
Severity high, CVSS 7.5
Record last updated
Sources & licenses
- Vulnerability data
- Wordfence Intelligence. [object Object] Licensed under the CC BY-SA 4.0.
- CVSS / CWE
- National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
- VulnCrest content
- Summary, remediation guidance and page layout © VulnCrest. Not sourced from NVD.