CVE-2025-5339

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5339", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-29T21:44:56.553Z", "datePublished": "2025-07-02T03:47:26.086Z", "dateUpdated": "2026-04-08T17:21:01.419Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:01.419Z"}, "affected": [{"vendor": "scripteo", "product": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.89", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018bsa_pro_id\u2019 parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Time-Based SQL Injection via \u2018bsa_pro_id'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e4e1e3-61a6-4c37-80dd-93b5cea440e3?source=cve"}, {"url": "http://localhost:1337/wp-content/plugins/ap-plugin-scripteo/lib/BSA_PRO_Model.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Tr\u01b0\u01a1ng H\u1eefu Ph\u00fac (truonghuuphuc)"}], "timeline": [{"time": "2025-07-01T14:54:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-02T13:18:10.280564Z", "id": "CVE-2025-5339", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-02T13:18:15.567Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5339", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-02T13:18:10.280564Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-02T13:18:13.039Z"}}], "cna": {"title": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Time-Based SQL Injection via \u2018bsa_pro_id'", "credits": [{"lang": "en", "type": "finder", "value": "Tr\u01b0\u01a1ng H\u1eefu Ph\u00fac (truonghuuphuc)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "scripteo", "product": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.89"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-01T14:54:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e4e1e3-61a6-4c37-80dd-93b5cea440e3?source=cve"}, {"url": "http://localhost:1337/wp-content/plugins/ap-plugin-scripteo/lib/BSA_PRO_Model.php"}], "descriptions": [{"lang": "en", "value": "The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018bsa_pro_id\u2019 parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:01.419Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5339", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:21:01.419Z", "dateReserved": "2025-05-29T21:44:56.553Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-02T03:47:26.086Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager", "vendor": "scripteo", "versions": [{"lessThanOrEqual": "4.89", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:scripteo:ads_pro:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "1F5A3BA9-1E6E-4BE0-B4BA-F69EC84C4BF5", "versionEndIncluding": "4.89", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018bsa_pro_id\u2019 parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El complemento Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager de WordPress, es vulnerable a la inyecci\u00f3n SQL basada en tiempo a trav\u00e9s del par\u00e1metro 'bsa_pro_id' en todas las versiones hasta la 4.89 incluida, debido a un escape insuficiente del par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n de la consulta SQL existente. Esto permite a atacantes no autenticados a\u00f1adir consultas SQL adicionales a las consultas existentes, que pueden utilizarse para extraer informaci\u00f3n confidencial de la base de datos."}], "id": "CVE-2025-5339", "lastModified": "2026-06-17T09:47:42.997", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5339", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-02T13:18:10.280564Z", "version": "2.0.3"}}]}, "published": "2025-07-02T04:15:57.677", "references": [{"source": "security@wordfence.com", "tags": ["Broken Link"], "url": "http://localhost:1337/wp-content/plugins/ap-plugin-scripteo/lib/BSA_PRO_Model.php"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e4e1e3-61a6-4c37-80dd-93b5cea440e3?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T01:11:38.255633+00:00", "value": {"mitigation_remediation": ["Upgrade the Ads Pro Plugin to the latest released version (\u22654.90) available from the scripteo or WordPress plugin repository.", "If an immediate update cannot be performed, temporarily disable the Ads Pro Plugin or block HTTP requests containing suspicious bsa_pro_id parameters using a web\u2011application firewall or access\u2011control list.", "Deploy a web\u2011application firewall configured to detect and block time\u2011based SQL injection attempts targeting the bsa_pro_id parameter."], "summary": {"action": "Immediate Patch", "impact": "Data Exfiltration"}, "threat_synthesis": {"affected_systems": "All installations of the Ads Pro Plugin \u2013 Multi\u2011Purpose WordPress Advertising Manager from scripteo, up to and including version 4.89, are affected. Versions newer than 4.89 have corrected the vulnerability.", "description_and_impact": "The Ads Pro Plugin for WordPress is vulnerable to time\u2011based SQL Injection via the bsa_pro_id parameter. The plugin fails to escape user input and does not properly prepare the SQL statement, allowing unauthenticated attackers to inject additional SQL code that can read sensitive database contents. The primary impact is the unauthorized disclosure of confidential information stored in the site's database.", "risk_and_exploitability": "The CVSS score of 7.5 indicates moderate to high severity. Although the EPSS score is low (<1%), the lack of authentication and straightforward injection logic increase the risk of exploitation in environments that expose the vulnerable endpoint. The vulnerability is not listed in CISA\u2019s KEV catalog, but the potential for data theft requires prompt attention. Exploitation would involve sending crafted bsa_pro_id values in HTTP requests, causing the underlying database to execute the injected query."}}}}, "created": "2026-04-22T01:15:07.312827+00:00", "updated": "2026-04-22T01:15:07.312837+00:00", "vendors": []}