CVE-2026-11984

Name of the Vulnerable Software and Affected Versions Ad Inserter – Ad Manager & AdSense Ads versions prior to 2.8.17

Description An authorization bypass exists due to a missing capability check on the ai-debug-code URL-parameter. This allows unauthenticated attackers to view header and footer code blocks configured by the administrator that were intended to be disabled from public display.

Recommendations Update the plugin to version 2.8.17 or later. As a temporary workaround, restrict access to the ai-debug-code parameter until the update is applied.