The plugin suffers from an unauthenticated data exposure vulnerability, allowing any user to read confidential information stored by the plugin. This flaw enables attackers to access sensitive data that should be protected by authentication and access controls, potentially revealing user or site data. The likely attack vector is through publicly accessible URLs provided by the plugin and no authentication is required.

WordPress sites using the Ads by WPQuads plugin, version 3.0.3 or earlier, are impacted. Those installations expose sensitive data via the plugin’s interfaces to any unauthenticated visitor.

The CVSS score of 7.5 marks this issue as high severity. The EPSS score is not available, but the lack of authentication makes exploitation trivial, so the vulnerability is likely to be actively abused. It is not listed in the CISA KEV catalog, yet the confidentiality impact warrants immediate attention.