Sensitive Information Exposure in Ad Inserter Plugin for WordPress

CVE-2026-89097

What is CVE-2026-89097?

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is affected by a vulnerability that allows authenticated attackers with subscriber-level access or higher to access sensitive server and configuration information. This includes the server's internal IP address, PHP configuration settings, WordPress and theme versions, hardening constants, and sensitive post meta values, including API tokens and private integration states utilized by other plugins. Attackers can exploit this flaw to gather sensitive data, potentially leading to further security breaches.

References