CVE-2026-89097: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in spacetime Ad Inserter – Ad Manager & AdSense Ads

CVE-2026-89097 is a sensitive information exposure vulnerability (CWE-200) in the Ad Inserter – Ad Manager & AdSense Ads WordPress plugin. Versions up to and including 2.8.18 allow authenticated attackers with subscriber-level privileges or higher to extract sensitive server and application data through the ai_wp_footer_hook. Extracted data includes internal IP addresses, PHP configuration details, WordPress and theme version information, plugin block matrix data, and protected post meta keys including API tokens and private integration states from other plugins. This vulnerability does not allow code execution or denial of service but leaks information that could aid further attacks.

An attacker with subscriber-level access can obtain sensitive server and application information that is normally protected. This information disclosure could facilitate further targeted attacks or privilege escalation. However, the vulnerability does not directly impact integrity or availability, only confidentiality to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access to trusted users only and monitor for suspicious activity. Review plugin updates regularly for a security patch addressing this issue.