CVE-2026-11984

MediumCVSS 5.3/10Last modified Sep 16, 2026

Description

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the `ai-debug-code` URL-parameter. This makes it possible for unauthenticated attackers to view administrator-configured header and footer code blocks that have been disabled from public display.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Sep 16, 2026
Last modified
Sep 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1198406.3Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges loCVE-2026-1198414.7Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to disclose information locally.CVE-2026-1198426.5A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser mayCVE-2026-1198436.5A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availabilitCVE-2026-1198447.0Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.CVE-2026-1198467.8Out-of-bounds read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.CVE-2026-1198477.8Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally.CVE-2026-1198485.3Improper input validation in Windows Message Queuing allows an authorized attacker to deny service over a network.CVE-2026-1198497.0Stack-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to execute code locally.CVE-2026-119853.6On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the "Floating point ABI" choice, which defaults to CONFIG_FP_HARDABI. CVE-2026-1198517.0Time-of-check time-of-use (toctou) race condition in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges lCVE-2026-1198526.7Missing authorization in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-11984: Medium severity, CVSS 5.3 | Vulnix