The ArielBrailovsky‑ViralAd plugin contains an SQL injection flaw (CWE‑89) in the limpia() function. Unsanitized 'text' and 'id' parameters allow attackers to inject arbitrary SQL statements, enabling arbitrary query execution. Because the injection is unauthenticated, any visitor can trigger it, potentially extracting sensitive data such as user credentials, content, or site configuration from the WordPress database.

All releases of the ArielBrailovsky‑ViralAd WordPress plugin up to version 1.0.8 are affected. The vulnerability is only exploitable on very old WordPress installations that still use legacy database schemas or older PHP versions. Newer WordPress cores and the plugin’s later releases eliminate the issue by using proper query preparation.

The CVSS score of 7.5 categorizes this flaw as high, yet the EPSS score of <1% indicates a low overall exploitation probability. The flaw is not listed in CISA’s KEV catalogue. Attackers need only a simple web request to the plugin’s endpoint; because authentication is not required, exploitation is straightforward, but the primary impact is data leakage rather than direct remote code execution, unless coupled with additional vulnerabilities.