The Ads Pro Plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) due to improper neutralization of special elements in the 'a_id' parameter. This parameter is used in SQL queries without sufficient escaping or parameterization, enabling unauthenticated attackers to append malicious SQL code. The vulnerability affects all versions up to 4.88 and can lead to unauthorized disclosure of sensitive data from the database. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality only.

Successful exploitation allows unauthenticated attackers to extract sensitive information from the database by injecting arbitrary SQL commands via the vulnerable 'a_id' parameter. The integrity and availability of the system are not impacted according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin to prevent exploitation. Monitoring for updates from the vendor or trusted security sources is recommended.