CVE-2024-13322

HIGHNuclei

Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.88 - Unauthenticated SQL Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-13322 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' parameter in all versions up to, and including, 4.88 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 2, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager

Browse scripteo / Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager

Default status: unaffected

CVE ListThrough 4.88affected

Nuclei templates

1
ProjectDiscoveryHIGHAds Pro Plugin <= 4.88 - Unauthenticated SQL InjectionCVSS 7.5

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' parameter in all versions up to, and including, 4.88 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Impact

Unauthenticated attackers can extract sensitive information from the database including usernames, passwords, and other confidential data via SQL injection.

Remediation

Update Ads Pro Plugin to a version newer than 4.88.

WeaknessesCWE-89
Authorsiamnoooob, rootxharsh, pdresearch
Template tagscvecve2024sqlitime-based-sqliwpwp-pluginwordpressvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ap-plugin-scripteo/ads-pro-plugin-multi-purpose-wordpress-advertising-manager-488-unauthenticated-sql-injection https://codecanyon.net/item/ads-pro-plugin-multipurpose-wordpress-advertising-manager/10275010 https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcb60a8-220f-45a4-a9a9-10f64acf470c?source=cve

Source: ProjectDiscovery

References

3