CyberRota Analysis
AI-GeneratedThe Ad Inserter WordPress plugin prior to version 2.8.19 has a vulnerability that allows any logged-in user, including those with minimal permissions like subscribers, to access and modify a settings page without proper restrictions. This flaw enables unauthorized users to store executable PHP code, which can be run on the server or displayed unescaped to site visitors, potentially leading to site compromise. WordPress site administrators, especially those using this plugin, should prioritize updating to the latest version to mitigate the risk.
Original NVD Description
The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.