The Ads Pro Plugin for WordPress is vulnerable to unauthenticated SQL injection through the $id parameter in the getSpace() function. Insufficient escaping and lack of prepared statements allow an attacker to inject and append arbitrary SQL queries, enabling the extraction of sensitive database information. The flaw is a classic CWE‑89 injection vulnerability that compromises the confidentiality of all data accessible via the plugin.

All WordPress sites running the Ads Pro Plugin – Multi‑Purpose WordPress Advertising Manager version 4.89 or earlier. The affected vendor is scripteo, and the plugin operates as a WordPress extension that can be installed on any WordPress installation.

This vulnerability carries a CVSS score of 7.5 and an EPSS score of less than 1 %, indicating a moderate to high severity but a low probability of exploitation at this time. The plugin does not require authentication to submit an $id value, so the attack vector is unrestricted web input. If exploited, an attacker could execute arbitrary SQL statements to retrieve confidential data. Because the vulnerability is not listed in CISA’s KEV catalog, it is not widely reported as a current exploit vector but should still be addressed promptly, especially on publicly exposed sites.