What is the CVSS score of CVE-2025-9987?

CVE-2025-9987 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Broadstreet WordPress Plugin CVE-2025-9987

EUVD-2025-209818 MEDIUM

Information Exposure (CWE-200)

2026-05-13 Wordfence

WordPress Information Disclosure Broadstreet Wordpress Plugin Broadstreetads

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 05:30 vuln.today

CVE Published

May 13, 2026 - 04:26 nvd

MEDIUM 5.3

DescriptionCVE.org

The Broadstreet plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.53.1 via the get_sponsored_meta() AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protected and private business details.

AnalysisAI

The Broadstreet WordPress plugin versions up to 1.53.1 exposes sensitive business information through an unauthenticated AJAX endpoint (get_sponsored_meta), allowing attackers to extract password-protected and private business details. Despite the CVSS vector indicating PR:N, the vulnerability requires subscriber-level or higher WordPress access, making authenticated users the primary attack vector. The exposure is limited to confidentiality impact with no integrity or availability compromise.

Technical ContextAI

The vulnerability exists in the get_sponsored_meta() AJAX action handler within the Broadstreet plugin, which is a WordPress advertising and sponsorship management plugin (CPE: cpe:2.3:a:broadstreetads:broadstreet). The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating insufficient access controls on data retrieval functions. AJAX endpoints in WordPress are callable by authenticated users if the nonce validation is absent or bypassed; in this case, the endpoint fails to properly restrict access to sensitive business metadata, allowing subscribers and above to query information that should only be accessible to administrators or the business owner.

RemediationAI

Update the Broadstreet plugin immediately to the version released after 1.53.1 (verify the exact version via the WordPress plugin repository changeset 3524817 or Wordfence advisory). The patch addresses the AJAX endpoint access control by implementing proper privilege checks in the get_sponsored_meta() function. Until patching is possible, site administrators should restrict subscriber-level user accounts to trusted individuals only and review user access logs for suspicious AJAX requests to get_sponsored_meta. Consider implementing WordPress security plugins that monitor AJAX endpoint access or manually disable the plugin if sensitive business data is critical - the trade-off is loss of sponsorship/advertising functionality until the patch is applied.