Authorization Bypass in Ad Inserter Plugin for WordPress

CVE-2026-11984

What is CVE-2026-11984?

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is susceptible to an authorization bypass flaw. This vulnerability arises from a lack of capability checks on the 'ai-debug-code' URL parameter, exposing administrator settings for header and footer code blocks. An unauthenticated attacker can exploit this weakness to view sensitive configuration details that were intended to be restricted from public access, potentially leading to further exploitation or data leakage.

References