Answer in brief
CVE-2026-11900 records a Medium severity (CVSS 4.3) vulnerability in Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute. The current sources do not mark it as known exploited. The current feed maps spacetime/Ad Inserter – Ad Manager & AdSense Ads (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-11900 records a Medium severity (CVSS 4.3) vulnerability in Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute. The current sources do not mark it as known exploited. The current feed maps spacetime/Ad Inserter – Ad Manager & AdSense Ads (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps spacetime/Ad Inserter – Ad Manager & AdSense Ads (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| spacetime/Ad Inserter – Ad Manager & AdSense Adsgeneric | 0 | Not reported |
Published upstream
Jul 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 3, 2026
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the [adinserter] shortcode. This is due to the replace_ai_tags() function processing a {reusable-block-N} tag pattern that calls get_post_field('post_content', N) without verifying the requesting user's capability with current_user_can('read_post'), without restricting the post type to 'wp_block', and without checking the post status. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the full content of arbitrary posts including Private, Draft, Pending, Trashed, and password-protected posts owned by other users, by placing the shortcode in a post they own and previewing it.
Quoted source text, attributed separately from HOL analysis.
CVSS is 4.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps spacetime/Ad Inserter – Ad Manager & AdSense Ads (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| spacetime/Ad Inserter – Ad Manager & AdSense Adsgeneric | 0 | Not reported |
Published upstream
Jul 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 3, 2026
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the [adinserter] shortcode. This is due to the replace_ai_tags() function processing a {reusable-block-N} tag pattern that calls get_post_field('post_content', N) without verifying the requesting user's capability with current_user_can('read_post'), without restricting the post type to 'wp_block', and without checking the post status. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the full content of arbitrary posts including Private, Draft, Pending, Trashed, and password-protected posts owned by other users, by placing the shortcode in a post they own and previewing it.
Quoted source text, attributed separately from HOL analysis.