CVE-2024-13322: Scripteo Ads Pro SQLi Vulnerability

CVE-2024-13322 Overview

CVE-2024-13322 is an unauthenticated SQL Injection vulnerability in the Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager. The flaw affects all versions up to and including 4.88. The vulnerability resides in the handling of the a_id parameter, where user-supplied input is neither escaped nor included in a properly prepared SQL statement. Attackers can append additional SQL queries to the existing query and extract sensitive information from the WordPress database. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents, including user credentials, session tokens, and configuration secrets, from any WordPress site running a vulnerable Ads Pro Plugin version.

Affected Products

Scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager, all versions through 4.88
WordPress installations with the vulnerable plugin enabled
Any site exposing the affected a_id endpoint to unauthenticated traffic

Discovery Timeline

2025-05-02 - CVE-2024-13322 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13322

Vulnerability Analysis

The Ads Pro Plugin processes the a_id request parameter inside an SQL query without sufficient sanitization or prepared statement binding. An unauthenticated attacker can inject SQL syntax that is concatenated directly into the active query. The injection point supports query stacking and UNION-based extraction, allowing attackers to read arbitrary tables in the WordPress database.

Because the plugin manages advertising campaigns, the vulnerable code path is reachable through public-facing endpoints used to render or interact with ads. No authentication is required, and no user interaction beyond a crafted HTTP request is necessary. Refer to the Wordfence Vulnerability Report for the technical advisory.

Root Cause

The root cause is twofold: insufficient escaping of the a_id parameter and lack of parameterized SQL preparation. The plugin builds the SQL statement by concatenating attacker-controlled input directly into the query string. WordPress provides the $wpdb->prepare() API specifically to avoid this pattern, but the vulnerable code path bypasses it.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends an HTTP request to the vulnerable plugin endpoint with a malicious payload in the a_id parameter. Typical payloads use UNION SELECT statements to retrieve data from the wp_users and wp_usermeta tables, including password hashes and email addresses. Time-based blind techniques are also viable when the response does not directly echo query output.

No verified public exploit code has been published. The vulnerability is described in the vendor and Wordfence advisories rather than through a proof-of-concept release.

Detection Methods for CVE-2024-13322

Indicators of Compromise

HTTP requests to Ads Pro Plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, or INFORMATION_SCHEMA in the a_id parameter
Unusual outbound database query patterns originating from the WordPress web server process
Web server access logs showing repeated requests to the same Ads Pro endpoint with varying a_id values
Unexpected reads of the wp_users or wp_options tables outside of normal administrative activity

Detection Strategies

Inspect web server and WAF logs for SQL metacharacters and tautologies in the a_id query string or POST body
Enable MySQL general query logging temporarily and alert on queries referencing wp_users initiated by Ads Pro code paths
Deploy WAF rules targeting CWE-89 patterns specifically on URIs associated with the Ads Pro Plugin

Monitoring Recommendations

Forward WordPress access logs, PHP error logs, and database query logs into a centralized analytics platform for correlation
Alert on response-time anomalies for Ads Pro endpoints, which can indicate time-based blind SQL injection
Track plugin version inventory across WordPress estates and flag any host still running Ads Pro 4.88 or earlier

How to Mitigate CVE-2024-13322

Immediate Actions Required

Update the Ads Pro Plugin to a version later than 4.88 as soon as the vendor publishes a fixed release
If no patched version is available, disable and remove the plugin from production WordPress instances
Audit the wp_users table and rotate all administrator credentials and API keys that may have been exposed
Review database and web server logs for signs of prior exploitation

Patch Information

Vendor patch availability should be confirmed through the Codecanyon Plugin Overview and the Wordfence Vulnerability Report. At the time of NVD publication, the advisory lists all versions up to and including 4.88 as vulnerable. Apply the latest available release from the official Codecanyon distribution channel.

Workarounds

Place a Web Application Firewall in front of the WordPress site and block requests where a_id contains SQL syntax
Restrict access to Ads Pro endpoints by IP allowlist where the plugin is used only for internal previews
Enforce least-privilege on the WordPress database user so injected queries cannot read tables outside the plugin's scope

bash

# Example ModSecurity rule to block SQL syntax in the a_id parameter
SecRule ARGS:a_id "@rx (?i)(union(\s|/\*.*?\*/)+select|sleep\s*\(|information_schema|--|;)" \
    "id:1013322,phase:2,deny,status:403,log,\
     msg:'CVE-2024-13322 Ads Pro Plugin SQLi attempt in a_id parameter'"