The vulnerability resides in the Advanced Ads – Ad Manager & AdSense WordPress plugin and allows an authenticated user with Administrator privileges or higher to inject arbitrary SQL statements through the unescaped 'order' parameter. Because the plugin concatenates this parameter directly into a query without proper preparation or escaping, an attacker can append additional commands to the original query, potentially extracting confidential information such as user credentials, system configuration, or other sensitive content.

WordPress sites running the Advanced Ads – Ad Manager & AdSense plugin for any release through version 2.0.15 are affected. The issue is isolated to the plugin’s admin interface; standard WordPress core functions are not directly impacted.

The CVSS score of 4.9 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of active exploitation in the wild, and the vulnerability is not noted in the CISA KEV catalog. Exploitation requires legitimate Administrator credentials or higher, so the attack surface is limited to sites with insecure admin access management. An attacker who can authenticate can construct injection payloads through the 'order' field to read or manipulate database rows.