CVE-2025-30876CWE-89

WordPress Ads by WPQuads plugin <= 2.0.87.1 - SQL Injection Vulnerability

Critical · published April 1, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
39.6
In the wild
Unconfirmed
What it is

🚨 An SQL injection vulnerability in Ads by WPQuads could let attackers manipulate your database with a few malicious commands! 🔥 Think of it like a restaurant where a sneaky diner can send back a perfectly good dish and request an entirely different recipe, altering the kitchen's database in the process. Without the right checks, the server might unknowingly serve up their demands! An attacker could gain unauthorized access and modify or extract sensitive data. This could lead to full control over your database, potentially resulting in data leaks or total disruption of your ads system!

Put simply

Think of it like a restaurant where a sneaky diner can send back a perfectly good dish and request an entirely different recipe, altering the kitchen's database in the process. Without the right checks, the server might unknowingly serve up their demands! The vulnerability arises from improper handling of special elements in SQL commands, allowing attackers to inject malicious SQL code into the query. This flaw affects versions of Ads by WPQuads up to 2.0.87.1.

What to do

An attacker could gain unauthorized access and modify or extract sensitive data. This could lead to full control over your database, potentially resulting in data leaks or total disruption of your ads system! To protect your system, update Ads by WPQuads to the latest version immediately. Implement prepared statements to safeguard against SQL injection attacks and conduct a thorough security audit of your database interactions. You’ve got this! Stay vigilant and follow these steps to secure your ads system and keep your data safe! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00469 · 39.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-04-01T05:31Z
EPSS history
Timeline
  • 01 APR 05:31Z
    WordPress Ads by WPQuads plugin <= 2.0.87.1 - SQL Injection Vulnerability
    cvelistv5