CVE-2025-12984 is an SQL Injection vulnerability in the Advanced Ads – Ad Manager & AdSense WordPress plugin affecting all versions up to 2.0.15. The issue arises from improper neutralization of special elements in the 'order' parameter, which is insufficiently escaped and not properly prepared in SQL queries. Authenticated attackers with Administrator privileges can exploit this to append malicious SQL queries, potentially extracting sensitive data from the database. The vulnerability has a CVSS 3.1 base score of 4.9, reflecting medium severity with network attack vector, low attack complexity, and high privileges required.

Successful exploitation allows authenticated administrators to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information stored in the database. There is no indication of impact on data integrity or availability. The vulnerability requires high privileges (Administrator-level access) and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator access to trusted users only and monitor for suspicious activity related to the 'order' parameter. Avoid using vulnerable plugin versions and consider disabling or replacing the plugin if possible.