Ad Inserter <= 2.8.18 Authenticated Information Disclosure in URL Parameters (CVE-2026-89097)

Vulnerability Overview Vulnerability Name: Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters CVE ID: CVE-2026-89097 CVSS Score: 4.3 (Medium) Publication Date: October 12, 2026 Last Updated: October 13, 2026 Researcher: Michal Kanas (Thor) - ELZA a.s. Affected Scope Affected Software: Ad Inserter – Ad Manager & AdSense Ads Affected Versions: <= 2.8.18 Fixed Version: 2.8.19 Remediation Recommendation: Update to version 2.8.19 or later fixed versions Vulnerability Description The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress exposes sensitive information in all versions up to and including 2.8.18. Attackers can extract sensitive data via the parameter, including internal server IP addresses, PHP configuration details, WordPress and theme versions, hardcoded constants, a complete matrix of the plugin, and meta values for all posts, including underscore-prefixed protected keys such as API tokens and private integration statuses. Reference Links plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Slug: ad-inserter (view on wordpress.org) Patched: Yes Affected Versions: <= 2.8.18 Fixed Version: 2.8.19 Recent Vulnerabilities Several vulnerabilities recently discovered in Ad Inserter – Ad Manager & AdSense Ads, including stored cross-site scripting (XSS), reflected cross-site scripting (XSS), and unauthorized access. Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved. License: Used subject to Defiant's license terms. Contact Technical Support: 24/7 support with a 1-hour response time. Email: support@wordfence.com Additional Resources Wordfence Intelligence: Offers free personal and commercial API access. Wordfence Website: Install Wordfence for instant notifications. Documentation: Review API documentation to learn how to access and use vulnerability data. Footer Information Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram Products and Services Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central Support Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support News Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories About About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form Update Subscription Subscribe to News: Sign up for news and updates from our panel of experienced security professionals. Business Hours Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT, excluding weekends and holidays. Response Time Response Time: 24/7 support, 365 days a year, with a 1-hour response time. Disclaimer Disclaimer: This record contains copyrighted material. License MITRE License: MITRE grants a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to copy, prepare derivative works of, publicly display, publicly perform, distribute, and distribute Common Vulnerabilities and Exposures (CVE). Contact Information Email: support@wordfence.com Additional Resources Wordfence Intelligence: Offers free personal and commercial API access. Wordfence Website: Install Wordfence for instant notifications. Documentation: Review API documentation to learn how to access and use vulnerability data. Footer Information Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram Products and Services Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central Support Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support News Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories About About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form Update Subscription Subscribe to News: Sign up for news and updates from our panel of experienced security professionals. Business Hours Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am

Goal Reached Thanks to every supporter — we hit 100%!

Ad Inserter <= 2.8.18 Authenticated Information Disclosure in URL Parameters (CVE-2026-89097)