CVE-2025-12984: 
WordPress vulnerability analysis and mitigation

CVE-2025-12984 is an authenticated SQL Injection vulnerability in the Advanced Ads – Ad Manager & AdSense plugin for WordPress, affecting all versions up to and including 2.0.15. The flaw exists in the order parameter due to insufficient escaping and lack of proper SQL query preparation, allowing authenticated attackers with Administrator-level access to extract sensitive information from the database. It was disclosed on January 17, 2026, by Wordfence, and carries a CVSS v3.1 base score of 4.9 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The root cause is insufficient escaping of the user-supplied order parameter in the plugin's placement list table handler (includes/admin/class-placement-list-table.php, line 254), combined with inadequate preparation of the underlying SQL query. An authenticated attacker with Administrator privileges can append additional SQL statements to the existing query via the order parameter, enabling blind or union-based SQL injection to enumerate and extract database contents (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated administrator-level attacker to extract sensitive information from the WordPress database, potentially including user credentials (hashed passwords), email addresses, configuration data, and other stored content. The vulnerability has no integrity or availability impact — it is limited to confidentiality. While the high privilege requirement limits the attack surface, in multi-administrator environments or following an account compromise, this flaw could facilitate further escalation or data exfiltration (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-12984. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.023%, reflecting a very low probability of near-term exploitation. The requirement for Administrator-level authentication significantly reduces the practical exploitability of this vulnerability (Feedly).

1. Authentication: Log in to the WordPress admin panel with an account holding Administrator-level privileges or higher.
2. Navigate to the vulnerable endpoint: Access the Advanced Ads plugin's placement management page within the WordPress admin dashboard, which loads the class-placement-list-table.php handler.
3. Intercept the request: Use a proxy tool (e.g., Burp Suite) to intercept the HTTP request that includes the order parameter used for sorting the placement list table.
4. Inject SQL payload: Modify the order parameter to append a malicious SQL fragment — for example, appending ,(SELECT SLEEP(5)) for time-based blind injection, or a UNION-based payload to extract data from other tables (e.g., wp_users).
5. Extract sensitive data: Iterate the injection to enumerate database tables, columns, and rows — targeting credentials, emails, or configuration secrets stored in the WordPress database (Wordfence, WordPress Trac).

• Logs: WordPress or web server access logs showing unusual or malformed order parameter values in requests to the Advanced Ads placement admin page (e.g., SQL keywords like UNION, SELECT, SLEEP, BENCHMARK, or encoded equivalents).
• Database: Unexpected or anomalous database query patterns in MySQL slow query logs or general query logs, particularly queries involving ORDER BY clauses with injected subqueries.
• Network: Repeated admin-panel requests to the Advanced Ads placement list endpoint from a single IP, especially with varying order parameter values indicative of enumeration.

Users should update the Advanced Ads – Ad Manager & AdSense plugin to version 2.0.16 or later, which includes the fix for this SQL injection vulnerability as reflected in the plugin's changeset (WordPress Changeset). As a temporary workaround, restrict Administrator access to trusted users only and consider using a Web Application Firewall (WAF) with SQL injection rules to filter malicious order parameter values. Regularly audit WordPress admin accounts to minimize the risk of credential compromise leading to exploitation (Wordfence).

Sucuri included CVE-2025-12984 in their January 2026 vulnerability patch roundup, highlighting it as part of a broader set of WordPress plugin vulnerabilities requiring attention (Sucuri Blog). No significant additional researcher commentary or social media discussion has been identified beyond standard vulnerability aggregator coverage.