CVE-2025-5339 describes a time-based SQL Injection vulnerability in the Ads Pro Plugin for WordPress, specifically via the 'bsa_pro_id' parameter. The plugin versions up to and including 4.89 do not properly escape user input or prepare SQL queries securely, enabling unauthenticated attackers to append malicious SQL commands. This can be exploited to extract sensitive data from the backend database without authentication. The vulnerability is categorized under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality only.

Successful exploitation allows unauthenticated attackers to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The integrity and availability of the system are not impacted according to the CVSS vector, but confidentiality is compromised. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the vulnerable parameter or employing web application firewall (WAF) rules to detect and block SQL injection attempts targeting 'bsa_pro_id'.