CVE-2019-15323

The Ad Inserter plugin before version 2.4.20 contains a vulnerability that allows users with subscriber-level access and above to exploit a nonce-based security flaw by retrieving the nonce through a specific cookie when making requests, contrary to the original report that suggested only administrators were affected. This flaw enables attackers to perform unauthorized actions on the website by bypassing the intended access restrictions.

Based on public CVE data (MITRE/NVD).