Overview
The Ads Pro Plugin – Multi-Purpose WordPress Advertising Manager plugin for WordPress has been found to be vulnerable to SQL Injection attacks. This vulnerability allows unauthenticated attackers to manipulate SQL queries, potentially leading to system compromise or data leakage. It affects all versions of the plugin up to and including 4.89, making it a significant cause for concern for WordPress users globally.
Vulnerability Summary
CVE ID: CVE-2025-6437
Severity: High (7.5 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Successful exploitation of this vulnerability could lead to unauthorized access, system compromise, and data leakage.
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Ads Pro Plugin – Multi-Purpose WordPress Advertising Manager | Up to and including 4.89
How the Exploit Works
The vulnerability arises from the insufficient escaping of the ‘oid’ parameter and the lack of sufficient preparation on the existing SQL query. An unauthenticated attacker can append additional SQL queries into the existing ones via this parameter. This could allow them to manipulate database transactions or extract sensitive information from the database.
Conceptual Example Code
Here’s a conceptual example of how the vulnerability might be exploited:
GET /index.php?oid=1' OR '1'='1'; SELECT * FROM wp_users; -- HTTP/1.1
Host: vulnerable-website.comIn this example, the attacker appends additional SQL queries to the ‘oid’ parameter, causing the database to return all the users’ data.
Mitigation
Users are strongly recommended to apply the vendor patch once it is available. As a temporary mitigation, users can implement a Web Application Firewall (WAF) or Intrusion Detection System (IDS). These can help prevent attacks by detecting and blocking malicious SQL queries.
