What is the CVSS score of CVE-2026-1881?

CVE-2026-1881 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Broadstreet WordPress Plugin CVE-2026-1881

EUVD-2026-31206 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-21 Wordfence

GHSA-2rfp-x828-47hv

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 02:27 vuln.today

DescriptionCVE.org

The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disclose any private post metadata.

AnalysisAI

Insecure Direct Object Reference in the Broadstreet WordPress plugin (all versions through 1.52.2) allows any authenticated user with Subscriber-level access to read arbitrary private post metadata by supplying a user-controlled key to the get_sponsored_meta AJAX endpoint without server-side authorization checks. The vulnerability stems from a missing object-level authorization check (CWE-639), a common class of flaw in WordPress plugin AJAX handlers. No public exploit code or active exploitation has been identified at time of analysis, and a patched version (1.53.2) is available via the WordPress plugin repository.

Technical ContextAI

CWE-639 (Authorization Through User-Controlled Key) describes a failure to validate whether the authenticated requester is authorized to access the specific object identified by a user-supplied key - distinct from authentication itself. The affected component is the get_sponsored_meta AJAX action registered by the Broadstreet plugin (CPE: cpe:2.3:a:broadstreetads:broadstreet:*:*:*:*:*:*:*:*), a WordPress ad management plugin by Broadstreet Ads. WordPress AJAX handlers registered via wp_ajax_ or wp_ajax_nopriv_ hooks are accessible over HTTP to any authenticated (or unauthenticated, respectively) user; when the handler does not verify whether the calling user has permission to access the requested post or metadata key, any valid WordPress account can enumerate and read metadata across all posts regardless of post visibility or ownership. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N reflects a low-complexity network-accessible read-only exposure scoped to the vulnerable application.

RemediationAI

Upgrade the Broadstreet plugin to version 1.53.2 or later; the fix is confirmed by the WordPress SVN changeset comparing tags 1.52.2 and 1.53.2 (https://plugins.trac.wordpress.org/changeset?old_path=%2Fbroadstreet/tags/1.52.2&new_path=%2Fbroadstreet/tags/1.53.2). The patch should be applied via the WordPress admin dashboard (Plugins > Updates) or WP-CLI. If an immediate upgrade is not feasible, a compensating control is to restrict AJAX access to the get_sponsored_meta action at the web server or WAF layer, blocking POST requests to wp-admin/admin-ajax.php with action=get_sponsored_meta from users who should not access post metadata - note this may break legitimate Broadstreet ad-serving functionality and should be tested in staging first. Additionally, auditing existing Subscriber-level accounts on affected sites is advisable to assess whether unauthorized metadata access has already occurred.