The Ads Pro Plugin – Multi‑Purpose WordPress Advertising Manager version 4.89 and earlier contain an unauthenticated SQL injection vulnerability. The 'oid' parameter is insufficiently sanitized and the query is not properly prepared, permitting attackers to inject arbitrary SQL statements. This flaw can lead to extraction of sensitive data from the MySQL database used by WordPress, compromising data confidentiality.

WordPress sites that have the Ads Pro Plugin installed from the scripteo vendor, specifically any version of the plugin up through 4.89. The vulnerability impacts any server that hosts a WordPress installation running these plugin versions and exposing the oid parameter in HTTP requests.

The CVSS score of 7.5 indicates a high severity issue, with an EPSS score of less than 1%, suggesting a relatively low probability of widespread automated exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker can issue a crafted HTTP request containing a malicious oid value to the plugin's endpoint, leading to arbitrary SQL query execution and data exfiltration. The lack of input validation and query preparation makes this exploit straightforward for an attacker with basic web application hacking skills.