CVE-2026-11900: CWE-639 Authorization Bypass Through User-Controlled Key in spacetime Ad Inserter – Ad Manager & AdSense Ads
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the [adinserter] shortcode. This is due to the replace_ai_tags() function processing a {reusable-block-N} tag pattern that calls get_post_field('post_content', N) without verifying the requesting user's capability with current_user_can('read_post'), without restricting the post type to 'wp_block', and without checking the post status. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the full content of arbitrary posts including Private, Draft, Pending, Trashed, and password-protected posts owned by other users, by placing the shortcode in a post they own and previewing it.
AI Analysis
Technical Summary
CVE-2026-11900 is an insecure direct object reference vulnerability in the Ad Inserter – Ad Manager & AdSense Ads WordPress plugin (<=2.8.16). The vulnerability arises from the replace_ai_tags() function processing the {reusable-block-N} tag pattern by calling get_post_field('post_content', N) without checking if the requesting user has read permissions (current_user_can('read_post')), without restricting the post type to 'wp_block', and without validating the post status. This allows authenticated users with Contributor-level privileges or higher to read the content of arbitrary posts, including those that are private, draft, pending, trashed, or password-protected, by embedding the shortcode in a post they own and previewing it.
Potential Impact
An attacker with Contributor-level or higher access can read sensitive content from posts they should not have access to, including private, draft, pending, trashed, and password-protected posts owned by other users. This leads to unauthorized disclosure of potentially sensitive information. The vulnerability does not affect integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access or higher to trusted users only. Monitor for plugin updates from spacetime and apply official patches once released.
CVE-2026-11900: CWE-639 Authorization Bypass Through User-Controlled Key in spacetime Ad Inserter – Ad Manager & AdSense Ads
Description
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the [adinserter] shortcode. This is due to the replace_ai_tags() function processing a {reusable-block-N} tag pattern that calls get_post_field('post_content', N) without verifying the requesting user's capability with current_user_can('read_post'), without restricting the post type to 'wp_block', and without checking the post status. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the full content of arbitrary posts including Private, Draft, Pending, Trashed, and password-protected posts owned by other users, by placing the shortcode in a post they own and previewing it.
CVSS v3.1
Score 4.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-11900 is an insecure direct object reference vulnerability in the Ad Inserter – Ad Manager & AdSense Ads WordPress plugin (<=2.8.16). The vulnerability arises from the replace_ai_tags() function processing the {reusable-block-N} tag pattern by calling get_post_field('post_content', N) without checking if the requesting user has read permissions (current_user_can('read_post')), without restricting the post type to 'wp_block', and without validating the post status. This allows authenticated users with Contributor-level privileges or higher to read the content of arbitrary posts, including those that are private, draft, pending, trashed, or password-protected, by embedding the shortcode in a post they own and previewing it.
Potential Impact
An attacker with Contributor-level or higher access can read sensitive content from posts they should not have access to, including private, draft, pending, trashed, and password-protected posts owned by other users. This leads to unauthorized disclosure of potentially sensitive information. The vulnerability does not affect integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access or higher to trusted users only. Monitor for plugin updates from spacetime and apply official patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-06-10T15:43:26.797Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a47782a27e9c797195c127b
Added to database: 07/03/2026, 08:51:54 UTC
Last enriched: 07/11/2026, 08:43:59 UTC
Last updated: 08/17/2026, 05:03:41 UTC
Views: 83
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.