The Ads Pro Plugin for WordPress contains an SQL Injection vulnerability (CWE-89) in the getSpace() function via the '$id' parameter. Due to insufficient escaping and lack of prepared statements, attackers can append malicious SQL commands to existing queries. This vulnerability affects all versions up to 4.89 and allows unauthenticated remote attackers to extract sensitive data from the backend database. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. No patch or remediation guidance is currently provided by the vendor.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, enabling them to extract sensitive information from the plugin's database. The vulnerability does not affect system availability or data integrity but compromises confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable plugin or restricting access to it. Monitor vendor channels for updates and apply patches promptly once available.