CVE-2026-11983

MediumCVSS 5.3/10Last modified Aug 12, 2026

Description

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the `ai_ajax` function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that an administrator has restricted to administrator-only visibility.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
spacetimeAd Inserter – Ad Manager & AdSense Ads<= 2.8.16

References

Timeline

Published
Aug 6, 2026
Last modified
Aug 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1198306.8Heap-based buffer overflow in Windows Storport Miniport Driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1198317.0Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-1198325.9Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature with a physical attack.CVE-2026-1198337.0Untrusted pointer dereference in Windows Message Queuing allows an authorized attacker to elevate privileges locally.CVE-2026-1198347.8Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.CVE-2026-1198357.0Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.CVE-2026-1198364.7Use after free in Windows Management Services allows an authorized attacker to disclose information locally.CVE-2026-1198377.5Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges loCVE-2026-1198384.7Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally.CVE-2026-1198398.8Untrusted search path in Remote Desktop Client allows an unauthorized attacker to elevate privileges over a network.CVE-2026-119845.3The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, CVE-2026-1198406.3Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges lo
CVE-2026-11983: Medium severity, CVSS 5.3 | Vulnix