CVE-2026-11983
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the `ai_ajax` function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that an administrator has restricted to administrator-only visibility.
Risk Assessment
The risk includes disclosure of confidential ad content, which may contain sensitive or strategic information, potentially compromising advertising campaigns.
Recommendation
Update the Ad Inserter plugin to the latest version that contains the fix. Also check for any unauthorized access to content.
Other vulnerabilities in Ad Inserter
See all- CVE-2026-11984Medium
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress (all versions up to and including 2.8.16) is vulnerable to authorization bypass due to a missing capability check on the 'ai-debug-code' URL parameter. An unauthenticated attacker can view administrator-configured header and footer code blocks that have been disabled from public display.
- CVE-2026-57693Medium
The Ad Inserter WordPress plugin version 2.8.11 and earlier contains a Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The flaw allows an attacker to exploit incorrectly configured access control security levels.
Original NVD description (English source)
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the `ai_ajax` function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that an administrator has restricted to administrator-only visibility.