CVE-2023-4668: falha de média gravidade em spacetime Ad Inserter – Ad Manager & AdSense Ads
Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.6%
The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data including installed plugins (present and active), active theme, various plugin settings, WordPress version, as well as some server settings such as memory limit, installation paths.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
spacetime · Ad Inserter – Ad Manager & AdSense AdsCVEs relacionadas — spacetime Ad Inserter – Ad Manager & AdSense Ads
No mesmo produto, das mais perigosas para as menos.
CVE-2023-4645MEDIUMAd Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai_ajaxEPSS 0.8%CVE-2026-11900MEDIUMAd Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode AttributeEPSS 0.5%CVE-2026-11983MEDIUMAd Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajaxEPSS 0.4%CVE-2026-102905MEDIUMAd Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search ParameterEPSS 0.4%CVE-2026-11984MEDIUMAd Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' ParameterEPSS 0.4%CVE-2026-9280MEDIUMAd Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe ModeEPSS 0.4%