AdRotate Banner Manager Authenticated PHP Code Injection via Shortcode (CVE-2026-12242)

Vulnerability Overview Vulnerability Name: AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute CVE ID: CVE-2026-12242 CVSS Score: 8.8 (High) Publication Date: June 23, 2026 Last Updated: June 24, 2026 Researcher: Osvaldo Noe Gonzalez Del Rio (Dy) - krei.dev / ogbuilders.io Affected Versions Software Type: Plugin Software Name: AdRotate Banner Manager Affected Versions: <= 5.17.7 Fixed Version: 5.17.8 Remediation Remediation: Update to version 5.17.8 or a newer patched version. Vulnerability Description The AdRotate Banner Manager plugin for WordPress contains a PHP code injection vulnerability. This vulnerability is caused by insufficient input validation and sanitization of the banner shortcode attribute. Attackers can exploit this by injecting PHP code strings into W3 Total Cache or Borsius Cache snippet tags, thereby executing arbitrary PHP code on the server. This vulnerability requires W3 Total Cache or Borsius Cache to be enabled in the AdRotate settings. References plugins.trac.wordpress.org Share Options Facebook X (Twitter) LinkedIn Email Additional Information Software Source: wordpress.org Patch Status: Fixed Remediation: Update to version 5.17.8 or a newer patched version Recent Vulnerability List More Information Copyright: 2012-2026 Defiant Inc. MITRE Copyright: 1999-2026 The MITRE Corporation Contact Technical Support: wfi-support@wordfence.com Other Resources Wordfence Intelligence: Provides free personal and commercial API access to the WordPress vulnerability database. Wordfence WordPress Plugin: Instantly notifies you if your site is affected by new vulnerabilities after installation. Documentation: Provides documentation on how to access and use the vulnerability data API. Business Hours Working Hours: 9am-8pm ET, 6am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support, 365 days a year, with a 1-hour response time Legal Disclaimer Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Data Sales: Do Not Sell or Share My Personal Information Social Media Twitter: X Facebook: f LinkedIn: in Instagram: O Products & Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscribe for Updates Subscribe: Sign up to receive news and updates from experienced security professionals. Email: you@example.com Agreement: By checking this box, I agree to the Terms of Service and Privacy Policy. Subscribe Button: SIGN UP Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Intelligence: Provides free personal and commercial API access to the WordPress vulnerability database. Wordfence WordPress Plugin: Instantly notifies you if your site is affected by new vulnerabilities after installation. Documentation: Provides documentation on how to access and use the vulnerability data API. Business Hours Working Hours: 9am-8pm ET, 6am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support, 365 days a year, with a 1-hour response time Legal Disclaimer Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Data Sales: Do Not Sell or Share My Personal Information Social Media Twitter: X Facebook: f LinkedIn: in Instagram: O Products & Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscribe for Updates Subscribe: Sign up to receive news and updates from experienced security professionals. Email: you@example.com Agreement: By checking this box, I agree to the Terms of Service and Privacy Policy. Subscribe Button: SIGN UP Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Intelligence: Provides free personal and commercial API access to the WordPress vulnerability database. Wordfence WordPress Plugin: Instantly notifies you if your site is affected by new vulnerabilities after installation. Documentation: Provides documentation on how to access and use the vulnerability data API. Business Hours Working Hours: 9am-8pm ET, 6am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support, 365 days a year, with a 1-hour response time Legal Disclaimer Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Data Sales: Do Not Sell or

Goal Reached Thanks to every supporter — we hit 100%!

AdRotate Banner Manager Authenticated PHP Code Injection via Shortcode (CVE-2026-12242)

More from this source