CVE-2026-11900

MediumCVSS 4.3

Published: 03/07/2026(UTC)Updated: 07/07/2026(UTC)Translated: 08/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress up to version 2.8.16 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'data' attribute of the [adinserter] shortcode. The replace_ai_tags() function processes a {reusable-block-N} tag pattern calling get_post_field('post_content', N) without verifying user capabilities, restricting the post type to 'wp_block', or checking the post status.

Risk Assessment

Authenticated attackers with Contributor-level access or above can read the full content of arbitrary posts, including Private, Draft, Pending, Trashed, and password-protected posts owned by other users, by placing the shortcode in a post they own and previewing it.

Recommendation

Immediately update the Ad Inserter plugin to the latest available version that fixes this vulnerability and restrict user permissions to the minimum necessary.

Other vulnerabilities in Ad Inserter – Ad Manager & AdSense Ads

CVE-2026-9280Medium
The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin up to version 2.8.15 is vulnerable to Reflected Cross-Site Scripting via URL parameters in iframe mode. Unauthenticated attackers can inject arbitrary scripts if they trick a user into clicking a link, and iframe mode is enabled on at least one ad block.

Original NVD description (English source)

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the [adinserter] shortcode. This is due to the replace_ai_tags() function processing a {reusable-block-N} tag pattern that calls get_post_field('post_content', N) without verifying the requesting user's capability with current_user_can('read_post'), without restricting the post type to 'wp_block', and without checking the post status. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the full content of arbitrary posts including Private, Draft, Pending, Trashed, and password-protected posts owned by other users, by placing the shortcode in a post they own and previewing it.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS