Is CVE-2026-11900 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11900 being exploited in the wild.

How severe is CVE-2026-11900?

Medium severity, with a CVSS score of 4.3, published 3 July 2026.

Which products and versions are affected?

Igor Funa Ad Inserter up to and including 2.8.16.

Is there a fix for CVE-2026-11900?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11900 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11900?

Check whether you run Igor Funa Ad Inserter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11900: Ad Inserter IDOR in replace_ai_tags function

CVE-2026-11900 · Severity: medium · CVSS 4.3 · Published 2026-07-03

The Ad Inserter plugin for WordPress, which is used to manage and display advertisements, contains a security flaw that allows certain users to view restricted content. Authenticated users with at least Contributor-level access can exploit this to read private, draft, or password-protected posts created by other authors. This could lead to the unauthorized disclosure of sensitive information or unpublished site content.

Technologies: Igor Funa Ad Inserter. Vendors: Igor Funa.

Quick answers

Is CVE-2026-11900 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11900 being exploited in the wild.
How severe is CVE-2026-11900?: Medium severity, with a CVSS score of 4.3, published 3 July 2026.
Which products and versions are affected?: Igor Funa Ad Inserter up to and including 2.8.16.
Is there a fix for CVE-2026-11900?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11900 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11900?: Check whether you run Igor Funa Ad Inserter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) located in the replace_ai_tags() function of the Ad Inserter plugin. The function processes a {reusable-block-N} tag pattern by calling get_post_field('post_content', N) without implementing proper authorization checks such as current_user_can('read_post'). Additionally, the plugin fails to restrict the post type to 'wp_block' or verify the post status. An authenticated attacker with Contributor-level permissions can exploit this by placing a crafted shortcode in a post they control and previewing it to retrieve the content of any post ID. A patch was released in version 2.8.17.

Affected products

spacetime Ad Inserter – Ad Manager & AdSense Ads up to and including 2.8.16

Timeline

2026-07-03: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.