Vulnerability record · CVE-2023-4668 · published 20 October 2023

CVE-2023-4668: Ad inserter project ad inserter missing authorization vulnerability

Ad Inserter Project · Ad Inserter

The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data including installed plugins (present and active), active theme, various plugin settings, WordPress version, as well as some server settings such as memory limit, installation paths.

7.5 CVSS 3.1 High EPSS 0.59% · top 53.8% CWE-862 · Missing authorization

7.5CVSS 3.1 base score

0.59%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Ad Inserter Ad Inserter Project

References

Link	Tags
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2969942%40ad-inserter%2Ftags%2F2.7.31&o	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/ce457c98-c55b-4b71-a80b-393eceb9effd?source=cve	Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2969942%40ad-inserter%2Ftags%2F2.7.31&o	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/ce457c98-c55b-4b71-a80b-393eceb9effd?source=cve	Third Party Advisory

Track CVE-2023-4668 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2015-9497Ad inserter project ad inserter cross-site request forgery vulnerabilityThe ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php.EPSS 0.98%22 Oct 2019 8.8CVE-2019-15324Ad inserter project ad inserter improper input validation vulnerabilityThe ad-inserter plugin before 2.4.22 for WordPress has remote code execution.EPSS 3.6%22 Aug 2019 7.5CVE-2019-15323Ad inserter project ad inserter path traversal vulnerabilityThe ad-inserter plugin before 2.4.20 for WordPress has path traversal.EPSS 2.0%22 Aug 2019 7.2CVE-2023-1549Ad inserter project ad inserter vulnerabilityThe Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users such as admi…EPSS 17%15 May 2023 6.1CVE-2022-0901Ad inserter project ad inserter cross-site scripting vulnerabilityThe Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, l…EPSS 3.6%4 Apr 2022 6.1CVE-2022-0288Ad inserter pro project ad inserter pro cross-site scripting vulnerabilityThe Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection …EPSS 2.1%21 Feb 2022 9.9CVE-2026-84869ScreenConnect client allows unauthorized file transfer and execution in remote sessionsA flaw in the ConnectWise ScreenConnect client lets files be transferred and executed inside an active remote session without authorization or Host c…KEVEPSS 0.92%analysed8 Sep 2026 7.8CVE-2022-0492Linux kernel cgroups v1 release_agent privilege escalation and container escapeThe Linux kernel's cgroup_release_agent_write in kernel/cgroup/cgroup-v1.c mishandles authorization, letting the cgroups v1 release_agent feature be …KEVEPSS 5.5%analysed3 Mar 2022

Source: NIST National Vulnerability Database (record CVE-2023-4668), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.