CVE-2026-94180

MediumCVSS 4.3

Published: 02/10/2026(UTC)Updated: 02/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

The Advanced Ads plugin (up to version 2.0.26) has an Authorization Bypass Through User-Controlled Key vulnerability, allowing retrieval of embedded sensitive data. An attacker can exploit a user-controlled key to bypass authorization.

Risk Assessment

Authorization bypass could allow access to sensitive data stored in the application. This may lead to information disclosure or confidentiality breaches.

Recommendation

Update the Advanced Ads plugin to a patched version. Conduct a security audit to identify similar vulnerabilities.

Other vulnerabilities in Advanced Ads

CVE-2026-10082Medium
The Advanced Ads WordPress plugin before version 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page. This allows users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged users.

Original NVD description (English source)

Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data. This issue affects Advanced Ads: from n/a through 2.0.26.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS