Ad Inserter EUVD-2026-114224

Exploitation is only possible when an administrator has created an Ad Inserter ad block containing a dynamic tag - specifically {title}, {tag}, {category}, or {smart-tag} - AND enabled that block's display on search pages; the plugin notes this is a normal, documented configuration but it is not universal, so sites without such a block on search pages are not exposed. Given that precondition, the attacker needs no authentication and no user interaction (per PR:N/UI:N), reaching the vulnerable do_shortcode path through a crafted search-page request. The limiting factors are therefore the required administrator-side configuration (dynamic tag present and shown on search results) and the inherently scoped impact (unchanged scope, low confidentiality/integrity, no availability effect), which together keep realistic risk below the raw unauthenticated-RCE impression the vector might give.

This is a medium-severity, conditionally-exploitable issue rather than a top-priority emergency. The input CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) describes an unauthenticated, network-reachable, low-complexity flaw with only LOW confidentiality and LOW integrity impact and no availability impact - consistent with CWE-94 code injection limited to shortcode output, not a full system takeover. The SSVC signals reinforce a measured response: Exploitation = none (no observed exploitation), Automatable = yes (the search-page trigger is scriptable once a vulnerable configuration exists), Technical Impact = partial. The vuln.today decision label is this_month, not act_now or emergency, so this should be scheduled into routine patching rather than treated as an incident. No KEV listing is present and no EPSS score was provided in the input, so exploitation probability cannot be quantified from the data given. No public exploit was identified - the supplied references are the Wordfence advisory plus WordPress trac source-code and changeset links, not working exploit code. The most important caveat is a signal mismatch: the CVSS vector reads as unauthenticated-remote against any instance, but the description states exploitation requires an administrator to have pre-configured an ad block containing a dynamic tag ({title}, {tag}, {category}, or {smart-tag}) with display enabled on search pages. That configuration dependency materially narrows the real-world exposed population below what the PR:N/AC:L vector alone implies. Note also the 'RCE' tag overstates impact - the CVSS integrity/confidentiality values are both LOW, so this is scoped shortcode execution, not confirmed remote code execution.

On a WordPress site where an administrator has configured an Ad Inserter ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} with display enabled on search pages, an unauthenticated attacker crafts a search request whose value is passed to do_shortcode without proper validation, causing arbitrary shortcodes to execute. No verified working exploit code was identified in the provided sources; the references are the vendor advisory and the plugin source/changeset.