CVE-2025-7402: Ads Pro Plugin WordPress SQLi Vulnerability

CVE-2025-7402 Overview

CVE-2025-7402 is a time-based SQL injection vulnerability in the Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager. The flaw exists in all plugin versions up to and including 4.95. It results from insufficient escaping of the user-supplied site_id parameter and inadequate preparation of the underlying SQL query. Unauthenticated attackers can append SQL queries to existing statements and extract sensitive data from the WordPress database. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated network attackers can extract sensitive database contents, including user credentials and personally identifiable information, through time-based SQL injection against the site_id parameter.

Affected Products

Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager versions through 4.95
WordPress installations that have the plugin enabled
Sites exposing plugin endpoints that accept the site_id parameter

Discovery Timeline

2025-11-24 - CVE-2025-7402 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-7402

Vulnerability Analysis

The Ads Pro Plugin processes the site_id request parameter and embeds it into a SQL query without sufficient escaping or parameterized preparation. Because the input is concatenated directly into the query, an attacker can break out of the expected value and inject additional SQL syntax. The exploitation pattern is time-based, meaning attackers infer query results by measuring response delays produced through payloads such as SLEEP() or conditional time functions. This technique works even when the application returns no visible error messages or data, making blind extraction of database contents possible.

No authentication is required, and no user interaction is needed. The vulnerability affects the confidentiality of the database, including stored WordPress user records, hashed credentials, session tokens, and any custom advertising data managed by the plugin.

Root Cause

The root cause is the absence of prepared statements and proper sanitization for the site_id parameter. WordPress provides the $wpdb->prepare() interface for parameterized queries, but the vulnerable code path passes the parameter into the SQL statement without binding it. Standard escape helpers such as esc_sql() or intval() are also missing, so attacker-controlled characters reach the SQL parser intact.

Attack Vector

An unauthenticated remote attacker submits a crafted HTTP request to a plugin endpoint that consumes site_id. The attacker supplies a payload that conditionally delays the database response based on a boolean test, then extracts data byte-by-byte by observing response time. Because the request is unauthenticated, the attacker only needs network reachability to the affected WordPress site. The vulnerability does not directly modify data or impact availability, but exfiltrated credentials can be reused to escalate access against the same or related systems.

No verified public proof-of-concept code is available. For technical specifics, see the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-7402

Indicators of Compromise

HTTP requests containing SQL keywords or time functions such as SLEEP(, BENCHMARK(, WAITFOR, or pg_sleep in the site_id parameter.
Unusually long response times from plugin endpoints, particularly responses that cluster around fixed multi-second intervals.
Repeated requests from a single IP address iterating through ASCII values or character positions, indicating blind data extraction.
Spikes in database query execution time correlated with web requests targeting Ads Pro Plugin paths.

Detection Strategies

Inspect web server access logs for requests where site_id contains non-numeric characters, URL-encoded quotes (%27), or comment markers (--, /*).
Deploy a web application firewall ruleset that flags SQL injection signatures targeting WordPress plugin endpoints.
Correlate slow query logs from MySQL or MariaDB with the corresponding web request timestamps to surface time-based injection attempts.

Monitoring Recommendations

Enable MySQL general query and slow query logging to capture suspicious SLEEP or conditional queries originating from the WordPress application user.
Alert on bursts of 4xx or extended-duration 2xx responses from plugin URLs.
Forward WordPress, PHP-FPM, and database logs to a centralized analytics platform for correlation across request, application, and database tiers.

How to Mitigate CVE-2025-7402

Immediate Actions Required

Identify all WordPress sites running the Ads Pro Plugin and confirm the installed version against 4.95 or earlier.
Restrict public access to plugin endpoints using a web application firewall or reverse proxy rules until a patched version is applied.
Rotate WordPress administrator passwords, API keys, and database credentials if exploitation is suspected.
Review database audit logs for unauthorized SELECT activity against wp_users and other sensitive tables.

Patch Information

No vendor patch URL is referenced in the NVD entry at publication. Site owners should consult the CodeCanyon Plugin Listing for vendor updates and install the latest available release as soon as it is published. Confirm the fixed version against the Wordfence Vulnerability Report before redeploying.

Workarounds

Disable the Ads Pro Plugin until a fixed version is installed if business requirements allow.
Add WAF rules that reject requests where the site_id parameter contains non-integer characters.
Limit access to WordPress administrative and AJAX endpoints by source IP where feasible.
Apply database-level least privilege so the WordPress user cannot read tables outside its required scope.

bash

# Example WAF rule (ModSecurity) blocking non-numeric site_id values
SecRule ARGS:site_id "!@rx ^[0-9]+$" \
    "id:1007402,phase:2,deny,status:403,\
    msg:'CVE-2025-7402: Non-numeric site_id parameter blocked'"