Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute

This research plan outlines the steps to demonstrate the Insecure Direct Object Reference (IDOR) vulnerability in the Ad Inserter plugin (CVE-2026-11900), which allows authenticated users (Contributor+) to disclose the content of arbitrary posts via a shortcode attribute.

1. Vulnerability Summary

The Ad Inserter plugin's replace_ai_tags() function is responsible for expanding various dynamic tags (placeholders) within ad block configurations and shortcodes. In versions up to and including 2.8.16, this function processes a {reusable-block-N} tag pattern where N is a post ID. The function retrieves the content using get_post_field('post_content', N) but fails to verify if the current user has permissions to read that specific post, nor does it restrict the post type to wp_block.

By placing the [adinserter] shortcode in a post and using the data attribute with this tag, a Contributor (who can create and preview their own posts) can force the server to fetch and display the content of any post (Drafts, Private, Password-protected) in the preview.

2. Attack Vector Analysis

• Entry Point: [adinserter] shortcode.
• Vulnerable Parameter: The data attribute.
• Payload: {reusable-block-POST_ID}.
• Authentication: Authenticated, Contributor level or higher.
• Precondition: At least one Ad Inserter block must be configured to output the data content (using the {#} or {DATA} tag). This is a standard feature used to pass dynamic data to ad blocks.

3. Code Flow

1. Contributor creates a post containing: [adinserter block="X" data="{reusable-block-Y}"].
2. When the post is previewed, WordPress calls the shortcode handler for adinserter.
3. The handler (likely ai_shortcode) parses the attributes, including data.
4. The plugin's rendering engine calls replace_ai_tags() on the data value.
5. replace_ai_tags() identifies the {reusable-block-Y} pattern.
6. get_post_field('post_content', Y) is called without checking current_user_can('read_post', Y).
7. The content of post Y is inserted into the data variable.
8. If Block X is configured with the {#} tag, the plugin replaces {#} with the "data" (the secret post content).
9. The rendered preview displays the content of post Y.

4. Nonce Acquisition Strategy

This exploit does not target a specific AJAX or Admin action but rather a shortcode processed during post rendering.

• Saving/Creating the Post: Requires the standard WordPress _wpnonce for post updates.
• Triggering the Leak: Occurs via a GET request to the post's preview URL. No plugin-specific nonce is required for shortcode execution.