Unvalidated input in the AdRotate WordPress plugin, versions prior to 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user.
ajdg adrotate