What is the CVSS score of CVE-2026-11983?

CVE-2026-11983 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Ad Inserter CVE-2026-11983

EUVD-2026-53865 MEDIUM

Missing Authorization (CWE-862)

2026-08-06 Wordfence

GHSA-74q3-73gr-qrvx

WordPress Authentication Bypass Wordpress Plugin Ad Inserter Ad Manager Adsense Ads Spacetime

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible AJAX endpoint requires no authentication; confidentiality impact is low (ad block contents only), with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 12:25 vuln.today

CVE Published

Aug 06, 2026 - 11:29 nvd

MEDIUM 5.3

DescriptionCVE.org

The Ad Inserter - Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the ai_ajax function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that an administrator has restricted to administrator-only visibility.

AnalysisAI

Authorization bypass in the Ad Inserter WordPress plugin (all versions through 2.8.16) allows unauthenticated remote attackers to read ad block contents that administrators have restricted to administrator-only visibility, by invoking the unguarded ai_ajax AJAX function. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial unauthenticated network exploitation with no user interaction required. No public exploit has been identified at time of analysis, but two upstream WordPress plugin repository changesets (3583409, 3567905) indicate a fix has been committed.

Technical ContextAI

The flaw is classified as CWE-862 (Missing Authorization), a common weakness in WordPress plugins where AJAX handler functions omit the required current_user_can() capability check before executing privileged operations. WordPress's AJAX subsystem routes requests through wp-admin/admin-ajax.php, and plugins register handlers via wp_ajax_ (authenticated) or wp_ajax_nopriv_ (unauthenticated) hooks. The ai_ajax function in Ad Inserter apparently accepts requests from either hook path but never validates whether the caller holds administrator privileges, allowing the visibility restriction to be trivially bypassed. The affected product is identified by CPE as cpe:2.3:a:spacetime:ad_inserter_-_ad_manager_&_adsense_ads:*:*:*:*:*:*:*:*, developed by Spacetime and distributed through the WordPress plugin repository.

RemediationAI

Update the Ad Inserter plugin to the version published after changesets 3583409 and 3567905 were committed to the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset/3583409 and https://plugins.trac.wordpress.org/changeset/3567905); verify via the WordPress admin plugin dashboard that the installed version post-dates 2.8.16, as the exact fixed release version is not independently confirmed from available data. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b5715acd-62e6-4cd8-8fe8-4b1412f287c9?source=cve should be monitored for a confirmed fixed version number. If immediate patching is not possible, deactivating the Ad Inserter plugin eliminates the attack surface entirely at the cost of ad serving functionality. As a less disruptive alternative, deploying a WAF rule to block unauthenticated POST requests to wp-admin/admin-ajax.php with the ai_ajax action parameter can mitigate exploitation, though this carries risk of interfering with other AJAX-dependent plugin functionality on the same installation.