CVE-2026-89097
Received Received - Intake

Sensitive Information Exposure in Ad Inserter WordPress Plugin

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Wordfence

Description
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the ai_wp_footer_hook. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive data including the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-89097
EUVD
EUVD-2026-98345

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
spacetime Ad Inserter – Ad Manager & AdSense Ads 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This WordPress plugin vulnerability allows authenticated users with subscriber-level access or higher to access sensitive server and site information. The flaw exists in versions up to 2.8.18 via the ai_wp_footer_hook function. Attackers can extract internal IP addresses, PHP settings, WordPress and theme versions, security constants, plugin configurations, and post meta data including API tokens and private keys.

Detection Guidance

Check WordPress sites using the Ad Inserter plugin for exposed sensitive data via the ai_wp_footer_hook endpoint. Inspect server responses for internal IP, PHP config, WordPress/theme versions, or post meta values. Use tools like curl to query the vulnerable endpoint directly.

Impact Analysis

An attacker could use this to gather intelligence about your WordPress site and server, potentially exposing API keys, internal network details, and other sensitive data. This information could be used for further attacks like privilege escalation, data theft, or targeted exploits against your site or connected services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information privacy). Exposure of API tokens, internal IPs, or user data may result in regulatory fines and loss of certification.

Mitigation Strategies

Update the Ad Inserter plugin to the latest version beyond 2.8.18. If an update is unavailable, disable the plugin temporarily. Restrict subscriber-level access to sensitive areas and audit post meta values for exposed secrets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89097. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart