CVE-2025-6437: Scripteo Ads Pro SQLi Vulnerability

CVE-2025-6437 Overview

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress contains a SQL Injection vulnerability in the oid parameter affecting all versions up to and including 4.89. Due to insufficient escaping on user-supplied input and lack of proper SQL query preparation, unauthenticated attackers can append malicious SQL queries to existing database operations. This vulnerability enables extraction of sensitive information from the WordPress database without requiring any authentication.

Critical Impact

Unauthenticated SQL Injection allows attackers to extract sensitive database contents including user credentials, personal information, and site configuration data without any authentication requirements.

Affected Products

• Scripteo Ads Pro plugin for WordPress versions up to and including 4.89
• WordPress sites running vulnerable Ads Pro Plugin installations
• All WordPress deployments utilizing the Multi-Purpose Advertising Manager functionality

Discovery Timeline

• 2025-07-02 - CVE-2025-6437 published to NVD
• 2025-07-08 - Last updated in NVD database

Technical Details for CVE-2025-6437

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists within the Ads Pro Plugin's handling of the oid parameter. The plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries, and does not utilize prepared statements or parameterized queries to safely handle the data. This architectural weakness creates a classic SQL Injection attack surface that can be exploited remotely over the network without any authentication or user interaction required.

The vulnerability is particularly dangerous because it can be exploited by unauthenticated attackers, meaning anyone with network access to the WordPress site can attempt exploitation. While the vulnerability primarily enables data extraction (confidentiality impact), the integrity and availability of the system remain unaffected by this specific attack vector.

Root Cause

The root cause stems from two fundamental security failures in the plugin's codebase:

1. Insufficient Input Escaping: The oid parameter is not properly escaped or sanitized before being used in SQL operations, allowing special SQL characters and commands to be interpreted as part of the query structure.

2. Lack of Prepared Statements: The plugin constructs SQL queries through string concatenation rather than using WordPress's $wpdb->prepare() function or other prepared statement mechanisms, which would separate SQL logic from user data.

Attack Vector

The attack vector for CVE-2025-6437 is network-based, requiring no authentication, no user interaction, and low attack complexity. An attacker can craft malicious HTTP requests containing SQL injection payloads within the oid parameter. When the vulnerable plugin processes these requests, the injected SQL commands are executed against the WordPress database.

Exploitation typically follows this pattern: the attacker identifies an endpoint accepting the oid parameter, then systematically extracts database information using techniques such as UNION-based injection, boolean-based blind injection, or time-based blind injection. The extracted data can include WordPress user tables containing usernames and password hashes, plugin configuration data, and any other sensitive information stored in the database.

For technical details on this vulnerability, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-6437

Indicators of Compromise

• Unusual database queries in MySQL/MariaDB slow query logs containing UNION SELECT, information_schema references, or sleep() functions
• Web server access logs showing requests to Ads Pro Plugin endpoints with suspicious oid parameter values containing SQL syntax
• Unexpected database read operations or export activities detected in WordPress database monitoring
• Error logs containing SQL syntax errors from malformed injection attempts

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the oid parameter
• Deploy database activity monitoring to alert on unusual query patterns including bulk SELECT operations on sensitive tables
• Configure intrusion detection systems to identify common SQL injection signatures in HTTP request parameters
• Enable WordPress debug logging to capture unexpected database errors that may indicate exploitation attempts

Monitoring Recommendations

• Monitor web server access logs for requests containing SQL metacharacters in query parameters
• Establish baseline database query patterns and alert on anomalous SELECT operations
• Review WordPress plugin audit logs for unauthorized access attempts
• Implement real-time alerting for database queries accessing user credential tables

How to Mitigate CVE-2025-6437

Immediate Actions Required

• Update the Ads Pro Plugin to a version newer than 4.89 if a patched version is available from the vendor
• If no patch is available, immediately deactivate and remove the Ads Pro Plugin from WordPress installations
• Review WordPress database for signs of unauthorized data access or extraction
• Rotate all WordPress user credentials, especially administrator accounts, as a precautionary measure

Patch Information

Organizations should check the CodeCanyon Product Listing for updated versions of the Ads Pro Plugin that address this vulnerability. Monitor the Wordfence Vulnerability Report for updates on patch availability and additional remediation guidance.

Workarounds

• Deploy a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious requests targeting the oid parameter
• Implement IP-based access controls to restrict access to WordPress administrative and plugin endpoints
• Use WordPress security plugins like Wordfence to add an additional layer of SQL injection protection
• Consider disabling the specific plugin functionality that utilizes the vulnerable oid parameter until a patch is available

# WordPress configuration - add to wp-config.php for additional database security
# Enable WordPress debug logging to detect exploitation attempts
define('WP_DEBUG', true);
define('WP_DEBUG_LOG', true);
define('WP_DEBUG_DISPLAY', false);

# Disable plugin via wp-cli if immediate deactivation is required
# wp plugin deactivate ads-pro-plugin