The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress contains a flaw in the ai_wp_footer_hook implementation that allows authenticated users with subscriber-level or higher access to retrieve sensitive data via the ai-debug-processing-fe and ai-debug-meta URL parameters. An attacker can glean the server’s internal IP address, PHP configuration details, WordPress core and theme versions, hardening constants, the plugin’s complete block matrix, and all post meta values, including underscore-prefixed protected keys that may hold API tokens or private integration state added by other plugins.

All installations of Ad Inserter up to and including version 2.8.18 are affected. The vulnerability is present in every release within the 2.8.x series prior to the 2.8.19 update, enabling exploitation for users with subscriber-level or higher permissions.

The CVSS score of 4.3 indicates a moderate rating. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker be logged into WordPress with at least subscriber privileges, after which the attacker can simply append the vulnerable parameters to legitimate requests to harvest the disclosed information.