CVE-2026-11900

Name of the Vulnerable Software and Affected Versions Ad Inserter – Ad Manager & AdSense Ads versions prior to 2.8.17

Description An Insecure Direct Object Reference exists via the data attribute of the [adinserter] shortcode. The replace ai tags() function processes a {reusable-block-N} tag pattern that calls get post field('post content', N) without verifying the user's capability via current user can('read post'), without restricting the post type to wp block, and without checking the post status. This allows authenticated attackers with Contributor-level access or higher to read the full content of arbitrary posts, including Private, Draft, Pending, Trashed, and password-protected posts owned by other users, by placing the shortcode in a post they own and previewing it.

Recommendations Update to a version newer than 2.8.16.