What the vulnerability does
01Description
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the [adinserter] shortcode. This is due to the replace_ai_tags() function processing a {reusable-block-N} tag pattern that calls get_post_field('post_content', N) without verifying the requesting user's capability with current_user_can('read_post'), without restricting the post type to 'wp_block', and without checking the post status. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the full content of arbitrary posts including Private, Draft, Pending, Trashed, and password-protected posts owned by other users, by placing the shortcode in a post they own and previewing it.
Explanation of Vulnerability in Simple Terms
02Summary
Ad Inserter versions up to 2.8.16 contain an authorization flaw that allows authenticated users with low privileges to read sensitive data they should not access. The vulnerability requires a valid user account and network access but no additional user interaction. Site administrators should update to a version newer than 2.8.16 to prevent unauthorized information disclosure.
What an attacker can do
03Attacker Capabilities
Read sensitive data accessible only to higher-privileged users.
Potential impact on your site
04Site Impact
Authenticated users can access confidential information beyond their permission level.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege user account on the site.
Key dates
06Disclosure timeline
July 3, 2026
CVE published
July 7, 2026
Record updated
