What is the CVSS score of CVE-2025-9988?

CVE-2025-9988 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Broadstreet WordPress Plugin CVE-2025-9988

EUVD-2025-209819 MEDIUM

Improper Authorization (CWE-285)

2026-05-13 Wordfence

WordPress Authentication Bypass Broadstreet Wordpress Plugin Broadstreetads

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 05:30 vuln.today

CVE Published

May 13, 2026 - 04:26 nvd

MEDIUM 4.3

DescriptionCVE.org

The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the create_advertiser AJAX action in all versions up to, and including, 1.53.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create advertisers.

AnalysisAI

Broadstreet WordPress plugin up to version 1.53.1 allows authenticated attackers with Subscriber-level access to create advertisers via missing capability checks on the create_advertiser AJAX action, enabling privilege escalation and unauthorized modification of advertising data.

Technical ContextAI

The vulnerability stems from a missing capability check (CWE-285: Improper Authorization) on a WordPress AJAX action handler. The create_advertiser AJAX endpoint fails to validate whether the requesting user has administrative permissions before processing advertiser creation requests. WordPress AJAX actions registered via add_action('wp_ajax_action') execute for any authenticated user unless explicitly restricted with capability checks (current_user_can()). Broadstreet fails to implement this authorization gate, allowing any logged-in user at Subscriber level or above to invoke the privileged advertiser creation function.

RemediationAI

Upgrade Broadstreet plugin to version 1.53.2 or later, which includes the capability check fix confirmed in WordPress plugin changeset 3524817. Administrators should apply this patch immediately on sites with open user registration. As a temporary compensating control before patching, restrict user registration via Settings > General > Membership in WordPress dashboard, limiting account creation to administrators only. Alternatively, use the User Role Editor plugin to remove the wp_ajax_create_advertiser capability from Subscriber and Contributor roles, though this requires manual management and may revert on plugin updates. Monitor user accounts created during the vulnerability window for suspicious advertiser creation activity.