PT-2025-27591 · WordPress · Ads Pro Plugin

Trương Hữu Phúc + 1 · Published 2025-07-02 · Updated 2025-07-07 · CVE-2025-5339

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager versions up to 4.89

Description: The issue is related to a time-based SQL injection vulnerability. It occurs due to insufficient escaping of the user-supplied bsa pro id parameter and a lack of proper preparation of the existing SQL query. This allows unauthenticated attackers to append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

Recommendations: For versions up to 4.89, update to a version higher than 4.89 to resolve the issue. As a temporary workaround, consider restricting access to the bsa pro id parameter to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-5339

Affected Products

Ads Pro Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-5339 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5339 · Vendor Advisory
• https://twitter.com/cracbot/status/1942176823447834788 · Twitter Post
• http://localhost:1337/wp-content/plugins/ap-plugin-scripteo/lib/BSA_PRO_Model.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c5e4e1e3-61a6-4c37-80dd-93b5cea440e3?source=cve · Note