CVE-2026-89097

MediumCVSS 4.3/10Last modified Oct 15, 2026

Description

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the ai_wp_footer_hook. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive data including the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 15, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-890985.5A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program asserti CVE-2026-890997.5A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory wi CVE-2026-89106.1The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is CVE-2026-891006.1The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL Fragment CVE-2026-891026.5In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can l CVE-2026-891054.2The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSU CVE-2026-891064.4SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially cr CVE-2026-891079.9SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that util CVE-2026-891089.1SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative function CVE-2026-89116.1The WP AutoBuzz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to CVE-2026-891109.9SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privile CVE-2026-8911110.0The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the ten