CVE-2026-89097

4.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-200

Impact

Authenticated attackers with subscriber-level access can extract internal server IPs, PHP configurations, and protected post meta containing API tokens and integration state. They only need a low-privileged account on the WordPress site.

Root cause

The ai_wp_footer_hook inadvertently exposes environment settings, configuration details, and protected post metadata to authenticated users.

Affected systems

Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress versions up to, and including, 2.8.18

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade the Ad Inserter plugin to a version newer than 2.8.18 once available. If patching must wait, disable the Ad Inserter plugin or deactivate subscriber account registration.

shell

$ wp plugin update ad-inserter

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the ai_wp_footer_hook. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive data including the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-89097