CVE-2026-89097

MEDIUM 4.3

Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the ai_wp_footer_hook. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive data including the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins.

CWE	CWE-200
Vendor	spacetime
Product	ad inserter – ad manager & adsense ads
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for spacetime ad inserter – ad manager & adsense ads

Be the first to know when new medium vulnerabilities affecting spacetime ad inserter – ad manager & adsense ads are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

spacetime / Ad Inserter – Ad Manager & AdSense Ads

0 ≤ 2.8.18

References

NVD ↗ CVE.org ↗ EPSS Data ↗

Credits

Michal Kanas (Thor)