CVE Database /
CVE-2026-11900
CVE · Medium
CVE-2026-11900 — Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.17
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-11900
|
Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.17 |
Authorization Bypass Through User-Controlled Key |
Medium
4.3
|
< 2.8.17
|
2.8.17 |
2026-07-02 |
—
|
CVE-2026-11900
Authenticated WordPress users with at least contributor privileges can exploit an insecure direct object reference vulnerability in Ad Inserter – Ad Manager & AdSense Ads plugin versions up to 2.8.16. The issue arises from the replace_ai_tags function's handling of reusable block tags, which allows attackers to bypass access controls and retrieve contents of posts they shouldn't be able to view. This can include private or password-protected posts owned by other users.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings