CVE-2024-13322

published 2025-05-02

CVE-2024-13322: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' parameter in all versions…

Priority P2 60 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' parameter in all versions up to, and including, 4.88 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
scripteo	ads_pro	< 4.89	4.89
scripteo	ads_pro_plugin_multi-purpose_wordpress_advertising_manager	<= 4.88	—

Detection & IOCs extracted from sources · hover to see the quote

other a_id↗

• → Monitor for unauthenticated HTTP requests containing SQL metacharacters or stacked/appended SQL syntax in the 'a_id' parameter targeting the Ads Pro Plugin endpoints. ↗
• → Flag requests to the Ads Pro Plugin where the 'a_id' parameter value contains SQL injection patterns (e.g., quotes, UNION, SELECT, or stacked queries); the vulnerability is exploitable without authentication. ↗

• · All versions up to and including 4.88 of the Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager are vulnerable; ensure patched versions above 4.88 are deployed. ↗
• · The vulnerability is exploitable by unauthenticated users, meaning no login or privilege is required to trigger the SQL injection via the 'a_id' parameter. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89