Advanced Ads – Ad Manager & AdSense <= 2.0.26 - Authenticated (Editor+) Sensitive Information Exposure via Author Search
- ID
- WPSEC-2026-1032
- Plugin
- Advanced Ads – Ad Manager & AdSense (advanced-ads)
- Affected
- all versions before 2.0.27
- Remediation
- Update to 2.0.27 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-15
- Attack surface
- Advanced Ads – Ad Manager & AdSense on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'advads-authors-search' AJAX action in all versions up to, and including, 2.0.26. This is due to the search_authors() function returning complete WP_User objects as JSON instead of only the fields the search needs. This makes it possible for authenticated attackers with ad editing rights to retrieve the email addresses, password hashes and password reset key hashes of users who can edit posts, including administrators. Ad editing rights belong to editors when the 'Allow editors to manage ads' setting is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1032/
- https://plugins.svn.wordpress.org/advanced-ads/tags/2.0.27/
- https://wordpress.org/plugins/advanced-ads/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS