CVE-2026-11983: falha de média gravidade em spacetime Ad Inserter – Ad Manager & AdSense Ads
Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the `ai_ajax` function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that an administrator has restricted to administrator-only visibility.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
spacetime · Ad Inserter – Ad Manager & AdSense AdsCVEs relacionadas — spacetime Ad Inserter – Ad Manager & AdSense Ads
No mesmo produto, das mais perigosas para as menos.
CVE-2023-4645MEDIUMAd Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai_ajaxEPSS 0.8%CVE-2023-4668MEDIUMAd Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-feEPSS 0.6%CVE-2026-11900MEDIUMAd Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode AttributeEPSS 0.5%CVE-2026-102905MEDIUMAd Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search ParameterEPSS 0.4%CVE-2026-11984MEDIUMAd Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' ParameterEPSS 0.4%CVE-2026-9280MEDIUMAd Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe ModeEPSS 0.4%