The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress contains an insecure direct object reference that allows authenticated users with Contributor level or higher to read the full content of any post. By inserting the [adinserter] shortcode with a 'data' attribute that includes a {reusable-block-N} tag, the plugin calls get_post_field('post_content', N) without checking the user’s capability, the post type, or the post status. As a result, an attacker can retrieve private, draft, pending, trashed, or password‑protected content belonging to other users, which is a classic CWE‑639 vulnerability.

WordPress sites that have the Ad Inserter plugin installed in any version up to and including 2.8.16 are affected. The vulnerability only requires permissions and to be able to place the preview it.

The CVSS score of 4.3 places this issue in the low severity range. The EPSS score of <1% indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating that large‑scale exploitation has not been observed. Exploitation requires local authenticated access and the ability to preview a post containing the shortcode. It does not provide remote code execution or denial of service; the risk is limited to confidentiality loss of post content.