The Ads Pro Plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) due to improper neutralization of special elements in the ‘oid’ parameter. This parameter is used in SQL queries without sufficient escaping or parameterization, enabling unauthenticated attackers to append malicious SQL code. The vulnerability affects all versions up to and including 4.89. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks via the ‘oid’ parameter, potentially extracting sensitive information from the database. The vulnerability impacts confidentiality but does not affect integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official scripteo communications for updates and patches addressing this vulnerability.