CVE-2026-11984
MediumCVSS 5.3Summary
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress (all versions up to and including 2.8.16) is vulnerable to authorization bypass due to a missing capability check on the 'ai-debug-code' URL parameter. An unauthenticated attacker can view administrator-configured header and footer code blocks that have been disabled from public display.
Risk Assessment
Exposure of hidden code blocks may help an attacker conduct further attacks, e.g., by learning the configuration or injecting malicious code. This can lead to a compromise of the site's security.
Recommendation
Update the Ad Inserter plugin to a version newer than 2.8.16 that contains the fix for this issue.
Other vulnerabilities in Ad Inserter
See all- CVE-2026-11983Medium
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the `ai_ajax` function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that an administrator has restricted to administrator-only visibility.
- CVE-2026-57693Medium
The Ad Inserter WordPress plugin version 2.8.11 and earlier contains a Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The flaw allows an attacker to exploit incorrectly configured access control security levels.
Original NVD description (English source)
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the `ai-debug-code` URL-parameter. This makes it possible for unauthenticated attackers to view administrator-configured header and footer code blocks that have been disabled from public display.