CVE-2025-5339 in Ads Pro Plugin
Summary
by MITRE • 07/02/2025
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa_pro_id’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/02/2025
The CVE-2025-5339 vulnerability affects the Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager, a widely used advertising management solution for wordpress platforms. This particular flaw exists in all versions up to and including 4.89, representing a critical security weakness that undermines the integrity of wordpress installations relying on this plugin. The vulnerability stems from inadequate input validation and sanitization practices within the plugin's codebase, creating an exploitable entry point for malicious actors seeking to compromise wordpress sites.
The technical exploitation occurs through a time-based sql injection attack vector targeting the 'bsa_pro_id' parameter. This parameter is processed without proper escaping or sanitization, allowing attackers to manipulate the sql query execution flow. The vulnerability manifests when user-supplied input is directly incorporated into sql queries without adequate preparation or parameterization. This flaw aligns with common weakness enumeration cwes 89 and 770, which specifically address sql injection vulnerabilities and improper input handling respectively. The time-based nature of the injection means that attackers can infer information from database responses through timing variations in query execution rather than direct data retrieval.
The operational impact of this vulnerability is severe for wordpress administrators and website owners who have not updated to patched versions of the plugin. Unauthenticated attackers can leverage this weakness to extract sensitive information from the underlying database, potentially accessing user credentials, personal data, content management details, and other confidential information stored within the wordpress installation. The lack of authentication requirements makes this vulnerability particularly dangerous as it can be exploited by anyone with access to the affected wordpress site. This weakness directly maps to attack techniques described in the mitre att&ck framework under initial access and credential access phases, specifically targeting the use of sql injection for data exfiltration.
Mitigation strategies for CVE-2025-5339 require immediate action from wordpress site administrators to update to the latest plugin versions that address this sql injection vulnerability. The recommended approach involves implementing proper input validation and parameterization of all user-supplied parameters within the plugin code. Additionally, organizations should consider implementing web application firewalls and database activity monitoring to detect potential exploitation attempts. Regular security audits and vulnerability assessments should be conducted to identify similar weaknesses in other installed plugins and themes. The vulnerability also underscores the importance of maintaining updated wordpress core installations and following security best practices for plugin management and access control.