The Ads Pro Plugin for WordPress is vulnerable to time‑based SQL Injection via the bsa_pro_id parameter. The plugin fails to escape user input and does not properly prepare the SQL statement, allowing unauthenticated attackers to inject additional SQL code that can read sensitive database contents. The primary impact is the unauthorized disclosure of confidential information stored in the site's database.

All installations of the Ads Pro Plugin – Multi‑Purpose WordPress Advertising Manager from scripteo, up to and including version 4.89, are affected. Versions newer than 4.89 have corrected the vulnerability.

The CVSS score of 7.5 indicates moderate to high severity. Although the EPSS score is low (<1%), the lack of authentication and straightforward injection logic increase the risk of exploitation in environments that expose the vulnerable endpoint. The vulnerability is not listed in CISA’s KEV catalog, but the potential for data theft requires prompt attention. Exploitation would involve sending crafted bsa_pro_id values in HTTP requests, causing the underlying database to execute the injected query.