The Ads Pro Plugin for WordPress is vulnerable to time‑based SQL Injection through the site_id parameter. Because the plugin fails to escape or prepare the user‑supplied value properly, unauthenticated attackers can inject additional SQL statements. This allows the attacker to pull sensitive data from the database, potentially exposing user information, configuration, or other confidential content. The weakness is classified as CWE‑89.

Scripteo offers the Ads Pro Plugin – Multi‑Purpose WordPress Advertising Manager. All released versions up to and including 4.95 are affected. The vulnerability is present in the plugin’s handling of the site_id parameter regardless of the WordPress installation version, but the specific workaround or patch depends on the plugin update channel for that vendor.

The CVSS score of 7.5 indicates a high severity, while an EPSS score of less than 1% points to a low exploitation probability at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically access the vulnerable endpoint over HTTP or HTTPS, sending a crafted site_id value; because the plugin does not verify authentication for that parameter, no privileged credentials are required. Once injected, the attacker can extract arbitrary data from the database, posing a significant confidentiality risk, although the overall likelihood of being exploited remains low under current threat intelligence.