High severity · published Oct 20, 2023
CVE-2023-4668
Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data including installed plugins (present and active), active theme, various plugin settings, WordPress version, as well as some server settings such as memory limit, installation paths.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Ad Inserter – Ad Manager & AdSense Ads · spacetime
through 2.7.30 · source: vendor
AI
AD Inserter · AD Inserter Project
before 2.7.31 · source: NVD
Affected product
AI
Ad Inserter – Ad Manager & AdSense Ads
spacetime
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4668
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4668
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2969942%40ad-inserter%2Ftags%2F2.7.31&old=2922718%40ad-inserter%2Ftrunk
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/ce457c98-c55b-4b71-a80b-393eceb9effd?source=cve
More from Ad Inserter – Ad Manager & AdSense Ads
6.4
CVE-2025-11745
Ad Inserter <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
6.1
CVE-2026-89427
Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter
6.1
CVE-2026-19902
Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
6.1
CVE-2026-9280
Ad Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Mode
5.3
CVE-2026-11984
Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter