CVE-2026-11983: Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the aiajax function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that an administrator has restricted to administrator-only visibility.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Ad Inserter – Ad Manager & AdSense Adsto a version that resolves this vulnerability.Fixed in 2.8.16 - Configuration
Update the plugin so the ai_ajax handler includes the required capability check before returning ad block contents.
WordPress plugin: Ad Inserter – Ad Manager & AdSense Ads Missing capability check in ai_ajax = Enforce an authorization/capability check in the ai_ajax function so restricted ad block visibility cannot be accessed without administrator capability
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11983?
CVE-2026-11983 has a medium severity score of 5.3.
How do I fix CVE-2026-11983?
To fix CVE-2026-11983, update the Ad Inserter plugin to version 2.8.17 or later.
What does CVE-2026-11983 affect?
CVE-2026-11983 affects the Ad Inserter plugin for WordPress in all versions up to and including 2.8.16.
What kind of attack can exploit CVE-2026-11983?
CVE-2026-11983 can be exploited by unauthenticated attackers to bypass authorization and view the contents of ad blocks.
What is the primary vulnerability in CVE-2026-11983?
The primary vulnerability in CVE-2026-11983 is a missing capability check in the ai_ajax function.