The Quads Ads Manager for Google AdSense WordPress plugin before version 3.0.5 contains an insufficient verification of data authenticity vulnerability (CWE-345). Specifically, it does not confirm with the payment gateway that a payment has been completed before marking an order as paid. This allows an attacker with the ability to place orders to bypass payment and receive paid ad placements fraudulently. The vulnerability affects versions >=3.0.4 and <3.0.5. The CVSS 3.1 base score is 4.3, indicating a medium severity issue with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impact limited to integrity.

An attacker who can place an order can obtain paid ad placements without completing payment, potentially causing financial loss to the site owner or misuse of advertising space. There is no impact on confidentiality or availability reported. No known exploits in the wild have been documented.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict order placement privileges to trusted users only and monitor for suspicious ad placements.