Advanced Ads Tracking EUVD-2026-112121

Requires the Advanced Ads - Tracking plugin installed and active at a version before 4.0.0, and an authenticated account with at least low privileges (per PR:L) - this is NOT exploitable by fully unauthenticated visitors based on the supplied vector. The specific tracking parameter, endpoint, or feature that carries the unneutralized input is not described in the available sources. Limiting factors: the authentication requirement meaningfully narrows the attacker population, and the impact is predominantly confidentiality via blind/inferential extraction (I:N, only A:L), which is slower and noisier than a direct error-based or UNION dump. The complete fix per the advisory is updating to version 4.0.0 or later.

This is a genuine but conditional priority. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) describes a network-reachable, low-complexity flaw that nevertheless requires privileges (PR:L) - so it is NOT unauthenticated. The high score is driven largely by the Scope change (S:C) plus C:H; the actual impact is primarily confidentiality (blind data extraction), with only A:L and no integrity impact claimed. Patchstack (the reporting source) assigned a 'this_week' priority rather than 'act_now'/'emergency', which aligns with the absence of a CISA KEV listing and no EPSS score in the supplied data. No EPSS exploitation-probability value, no SSVC automatable/technical-impact decision, and no confirmed working exploit were provided, so widespread opportunistic exploitation cannot be asserted - this reads as a credible, patch-this-cycle issue rather than an active emergency. One signal to verify with the vendor: the supplied vector sets S:C (scope change), which is atypical for most WordPress-plugin SQL injections where the database is in-scope for the application; confirm whether a true privilege/scope boundary is actually crossed.

An attacker who already holds a low-privileged authenticated account on a WordPress site running Advanced Ads - Tracking before 4.0.0 submits crafted input to a vulnerable tracking parameter. Because the input is not properly neutralized before being used in a SQL command, the attacker performs blind SQL injection to infer and extract database contents (such as user records or secrets) one query at a time. No public exploit code was identified in the supplied data, and exploitation requires the authenticated access indicated by PR:L.