Atomic Edge analysis of CVE-2026-12242:
This vulnerability is a PHP Code Injection flaw in the AdRotate Banner Manager plugin for WordPress, all versions up to and including 5.17.7. It allows authenticated attackers with Contributor-level access and above to inject and execute arbitrary PHP code on the server. The vulnerability exists in the ‘adrotate_shortcode’ function, which processes the ‘banner’ attribute of the adrotate shortcode. The CVSS score is 8.8, indicating high severity. The exploit requires W3 Total Cache or Borlabs Cache support to be enabled within the AdRotate plugin settings.
The root cause is insufficient input validation and sanitization of the ‘banner’ attribute from the shortcode. In the vulnerable version, the function adrotate_shortcode() in /wp-content/plugins/adrotate/adrotate-output.php (line 265) directly takes the user-supplied value from $atts[‘banner’], trims whitespace characters, but does not enforce an integer type. When W3 Total Cache or Borlabs Cache is enabled, the plugin wraps the shortcode output in PHP code markers ( and for W3 Total Cache, or similar markers for Borlabs Cache). The banner ID value is concatenated directly into a PHP code string within these markers, allowing a malicious user to break out of the intended context and inject arbitrary PHP code.
An attacker with at least Contributor-level permissions can craft a post or page containing the adrotate shortcode with a malicious ‘banner’ attribute. For example: [adrotate banner=”1; system(‘id’); //”]. When the shortcode is processed, the banner value is placed inside the PHP code block generated for caching. If W3 Total Cache or Borlabs Cache support is enabled, the plugin executes the resulting PHP string as code, triggering the injected command. The attacker does not need to interact with any additional endpoints; the exploit occurs on post/page rendering.
The patch (diff shown) adds input sanitization to the ‘banner’ attribute by wrapping the trimmed value with absint(), which converts the input to an absolute integer. This ensures that only numeric values are accepted, preventing any string-based injection. Additionally, the patch introduces a regex validation for the ‘group’ attribute to ensure it is a comma-separated list of digits. These changes prevent the concatenation of non-numeric content into the PHP code string, effectively blocking the injection vector.
Successful exploitation leads to remote code execution (RCE) on the WordPress server. An attacker can execute arbitrary operating system commands, read or modify sensitive files, create backdoors, escalate privileges, or pivot to other internal systems. This represents a complete compromise of the web application and potentially the underlying server.
