[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fC_pj_xaY3Za0uZbvCB5AOilyMzotK9NlzmHOPa9DtcA":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-11900","ad-inserter-insecure-direct-object-reference-to-authenticated-contributor-arbitrary-post-content-disclosure-via-data-sho","Ad Inserter \u003C= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute","The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the [adinserter] shortcode. This is due to the replace_ai_tags() function processing a {reusable-block-N} tag pattern that calls get_post_field('post_content', N) without verifying the requesting user's capability with current_user_can('read_post'), without restricting the post type to 'wp_block', and without checking the post status. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the full content of arbitrary posts including Private, Draft, Pending, Trashed, and password-protected posts owned by other users, by placing the shortcode in a post they own and previewing it.","ad-inserter",null,"\u003C=2.8.16","2.8.17","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Authorization Bypass Through User-Controlled Key","2026-07-02 19:01:12","2026-07-03 07:53:08",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F20f0e9ae-786b-4ba8-a6d5-92bf31ebc2c7?source=api-prod",1,[22,23,24,25,26,27,28,29],"ad-inserter.php","changelog.txt","class.php","constants.php","css\u002Fai-settings.css","images\u002Fwu-25.png","images\u002Fwu-72.png","js\u002Fad-inserter.js","researched",false,3,"This research plan outlines the steps to demonstrate the Insecure Direct Object Reference (IDOR) vulnerability in the Ad Inserter plugin (CVE-2026-11900), which allows authenticated users (Contributor+) to disclose the content of arbitrary posts via a shortcode attribute.\n\n### 1. Vulnerability Summary\nThe Ad Inserter plugin's `replace_ai_tags()` function is responsible for expanding various dynamic tags (placeholders) within ad block configurations and shortcodes. In versions up to and including 2.8.16, this function processes a `{reusable-block-N}` tag pattern where `N` is a post ID. The function retrieves the content using `get_post_field('post_content', N)` but fails to verify if the current user has permissions to read that specific post, nor does it restrict the post type to `wp_block`.\n\nBy placing the `[adinserter]` shortcode in a post and using the `data` attribute with this tag, a Contributor (who can create and preview their own posts) can force the server to fetch and display the content of any post (Drafts, Private, Password-protected) in the preview.\n\n### 2. Attack Vector Analysis\n- **Entry Point**: `[adinserter]` shortcode.\n- **Vulnerable Parameter**: The `data` attribute.\n- **Payload**: `{reusable-block-POST_ID}`.\n- **Authentication**: Authenticated, Contributor level or higher.\n- **Precondition**: At least one Ad Inserter block must be configured to output the `data` content (using the `{#}` or `{DATA}` tag). This is a standard feature used to pass dynamic data to ad blocks.\n\n### 3. Code Flow\n1.  **Contributor** creates a post containing: `[adinserter block=\"X\" data=\"{reusable-block-Y}\"]`.\n2.  When the post is previewed, WordPress calls the shortcode handler for `adinserter`.\n3.  The handler (likely `ai_shortcode`) parses the attributes, including `data`.\n4.  The plugin's rendering engine calls `replace_ai_tags()` on the `data` value.\n5.  `replace_ai_tags()` identifies the `{reusable-block-Y}` pattern.\n6.  `get_post_field('post_content', Y)` is called without checking `current_user_can('read_post', Y)`.\n7.  The content of post `Y` is inserted into the `data` variable.\n8.  If Block `X` is configured with the `{#}` tag, the plugin replaces `{#}` with the \"data\" (the secret post content).\n9.  The rendered preview displays the content of post `Y`.\n\n### 4. Nonce Acquisition Strategy\nThis exploit does not target a specific AJAX or Admin action but rather a **shortcode** processed during post rendering.\n- **Saving\u002FCreating the Post**: Requires the standard WordPress `_wpnonce` for post updates.\n- **Triggering the Leak**: Occurs via a GET request to the post's preview URL. No plugin-specific nonce is required for shortcode execution.","gemini-3-flash-preview","2026-07-25 09:48:01","2026-07-25 09:48:46",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","2.8.16","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fad-inserter\u002Ftags\u002F2.8.16","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fad-inserter.2.8.16.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fad-inserter\u002Ftags\u002F2.8.17","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fad-inserter.2.8.17.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fad-inserter\u002Ftags"]