Executive brief
Ad Inserter is a popular WordPress plugin for managing advertisements and AdSense integration on websites. The plugin fails to properly verify user permissions when handling debug code requests, allowing unauthorized visitors to view sensitive administrator-configured code blocks that should be hidden from public access. This could expose private configuration details or allow attackers to gather intelligence about the site's setup.
Technical details
The Ad Inserter plugin contains an authorization bypass vulnerability in the handling of the `ai-debug-code` URL parameter. The plugin fails to implement a capability check before processing debug code requests, allowing unauthenticated users to access protected functionality. An attacker can craft a request with the vulnerable parameter to retrieve header and footer code blocks that administrators have disabled from public display, potentially exposing sensitive configuration data, API keys, or tracking code. The vulnerability affects all versions through 2.8.16; patches are available in later releases.
Affected products
- Automattic Ad Inserter up to and including 2.8.16
Timeline
- 2026-09-16: disclosed