Is CVE-2026-89050 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89050 being exploited in the wild.

How severe is CVE-2026-89050?

Medium severity, with a CVSS score of 4.3, published 13 September 2026.

Which products and versions are affected?

Automattic Quads Ads Manager for Google AdSense before 3.0.5.

Is there a fix for CVE-2026-89050?

A patch was published on 2026-09-11: Fixed in version 3.0.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89050 attacked?

It is attacked over the network.

Am I affected by CVE-2026-89050?

Check whether you run Automattic Quads Ads Manager for Google AdSense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89050: Quads Ads Manager payment bypass in ad-selling order processing

CVE-2026-89050 · Severity: medium · CVSS 4.3 · Published 2026-09-13

Quads is a WordPress plugin that manages Google AdSense integration and allows sites to sell ad placements to third parties. The plugin fails to verify payment completion with payment gateways before marking ad orders as paid, allowing attackers to purchase ad placements without actually paying. An attacker can register an account, place an order, and directly access the payment success URL to mark the order as paid without any actual transaction.

Vendors: Automattic.

Quick answers

Is CVE-2026-89050 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89050 being exploited in the wild.
How severe is CVE-2026-89050?: Medium severity, with a CVSS score of 4.3, published 13 September 2026.
Which products and versions are affected?: Automattic Quads Ads Manager for Google AdSense before 3.0.5.
Is there a fix for CVE-2026-89050?: A patch was published on 2026-09-11: Fixed in version 3.0.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89050 attacked?: It is attacked over the network.
Am I affected by CVE-2026-89050?: Check whether you run Automattic Quads Ads Manager for Google AdSense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a payment verification bypass in the ad-selling order workflow. When a user places an ad purchase order, the plugin generates a success URL containing an order ID and security nonce. However, the plugin does not validate with the actual payment gateway (Stripe, Paystack, or Authorize.net) that payment was completed before accepting the success callback; instead, simply accessing the success URL with a valid nonce flips the order status from pending to paid. The attack is network-accessible and requires no authentication beyond creating a free subscriber account. An attacker can obtain paid ad placements indefinitely without payment. The vulnerability was fixed in version 3.0.5.

Affected products

Automattic Quads Ads Manager for Google AdSense before 3.0.5

Timeline

2026-09-11: disclosed
2026-09-13: published
2026-09-11: patched: Fixed in version 3.0.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.