Ad Inserter <= 2.8.16 — Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Ad Inserter – Ad Manager & AdSense Ads.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 2.8.17, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Ad Inserter – Ad Manager & AdSense Ads to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to nightward.

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the [adinserter] shortcode. This is due to the replace_ai_tags() function processing a {reusable-block-N} tag pattern that calls get_post_field('post_content', N) without verifying the requesting user's capability with current_user_can('read_post'), without restricting the post type to 'wp_block', and without checking the post status. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the full content of arbitrary posts including Private, Draft, Pending, Trashed, and password-protected posts owned by other users, by placing the shortcode in a post they own and previewing it.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Jul 2, 2026

   CVE published

   Severity medium, CVSS 4.3

2. Nov 13, 2026

   Record last updated