CVE-2026-11984: Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view administrator-configured header and footer code blocks that have been disabled from public display.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ad Inserter – Ad Manager & AdSense Ads (WordPress plugin)to a version that resolves this vulnerability.Fixed in 2.8.16 - Configuration
Update/patch Ad Inserter so the `ai-debug-code` URL parameter performs the missing capability check; ensure unauthenticated requests cannot view disabled administrator header/footer code blocks.
Ad Inserter – Ad Manager & AdSense Ads (WordPress plugin) Capability check for ai-debug-code parameter on header/footer code disclosure = Enforce authorization/capability validation before allowing unauthenticated access to administrator-configured header/footer code blocks.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. No WordPress account or elevated privileges are required.
What information could be exposed?
An attacker can view administrator-configured header and footer code blocks that were disabled from public display. The reported impact is limited to disclosure of that code; no integrity or availability impact is specified.
Which installations are affected?
Affected installations use the Ad Inserter – Ad Manager & AdSense Ads WordPress plugin at version 2.8.16 or earlier. The issue is reachable through the ai-debug-code URL parameter.