# CVE-2026-89097: Ad Inserter sensitive information exposure

Source: https://junglewise.ai/threats/cve-2026-89097-the-ad-inserter-ad-manager-adsense-ads-plugin-for-wordpress-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-89097 · Severity: medium · CVSS 4.3 · Published 2026-10-13

The Ad Inserter WordPress plugin, which manages advertisements and AdSense integration on websites, exposes sensitive server and site configuration data through an insecure footer function. Attackers with subscriber-level access or higher can extract server IP addresses, PHP settings, API tokens, and other protected information stored by plugins, potentially enabling further attacks or data theft.

Vendors: [Automattic](https://junglewise.ai/threats/vendors/automattic).

## Quick answers

**Is CVE-2026-89097 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89097 being exploited in the wild.

**How severe is CVE-2026-89097?** Medium severity, with a CVSS score of 4.3, published 13 October 2026.

**Which products and versions are affected?** Automattic Ad Inserter up to and including 2.8.18.

**Is there a fix for CVE-2026-89097?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89097 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-89097?** Check whether you run Automattic Ad Inserter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a sensitive information exposure flaw in the ai_wp_footer_hook function that leaks protected data accessible only to the WordPress database. Authenticated attackers with subscriber or higher privileges can access server IP addresses, PHP configuration, WordPress versions, plugin configuration including API credentials and protected post metadata. The issue requires authentication and database access but no user interaction.

## Affected products

- Automattic Ad Inserter up to and including 2.8.18

## Timeline

- 2026-10-13: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.18/ad-inserter.php](https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.18/ad-inserter.php)
- [https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.18/ad-inserter.php](https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.18/ad-inserter.php)

## Related threats

- [Ad Inserter arbitrary shortcode execution in dynamic tags](https://junglewise.ai/threats/cve-2026-102905-the-the-ad-inserter-ad-manager-adsense-ads-plugin-for-wordpress)