EUVD-2026-31206
GHSA-2rfp-x828-47hv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
1DescriptionCVE.org
The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disclose any private post metadata.
AnalysisAI
Insecure Direct Object Reference in the Broadstreet WordPress plugin (all versions through 1.52.2) allows any authenticated user with Subscriber-level access to read arbitrary private post metadata by supplying a user-controlled key to the get_sponsored_meta AJAX endpoint without server-side authorization checks. The vulnerability stems from a missing object-level authorization check (CWE-639), a common class of flaw in WordPress plugin AJAX handlers. No public exploit code or active exploitation has been identified at time of analysis, and a patched version (1.53.2) is available via the WordPress plugin repository.
Technical ContextAI
CWE-639 (Authorization Through User-Controlled Key) describes a failure to validate whether the authenticated requester is authorized to access the specific object identified by a user-supplied key - distinct from authentication itself. The affected component is the get_sponsored_meta AJAX action registered by the Broadstreet plugin (CPE: cpe:2.3:a:broadstreetads:broadstreet:*:*:*:*:*:*:*:*), a WordPress ad management plugin by Broadstreet Ads. WordPress AJAX handlers registered via wp_ajax_ or wp_ajax_nopriv_ hooks are accessible over HTTP to any authenticated (or unauthenticated, respectively) user; when the handler does not verify whether the calling user has permission to access the requested post or metadata key, any valid WordPress account can enumerate and read metadata across all posts regardless of post visibility or ownership. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N reflects a low-complexity network-accessible read-only exposure scoped to the vulnerable application.
RemediationAI
Upgrade the Broadstreet plugin to version 1.53.2 or later; the fix is confirmed by the WordPress SVN changeset comparing tags 1.52.2 and 1.53.2 (https://plugins.trac.wordpress.org/changeset?old_path=%2Fbroadstreet/tags/1.52.2&new_path=%2Fbroadstreet/tags/1.53.2). The patch should be applied via the WordPress admin dashboard (Plugins > Updates) or WP-CLI. If an immediate upgrade is not feasible, a compensating control is to restrict AJAX access to the get_sponsored_meta action at the web server or WAF layer, blocking POST requests to wp-admin/admin-ajax.php with action=get_sponsored_meta from users who should not access post metadata - note this may break legitimate Broadstreet ad-serving functionality and should be tested in staging first. Additionally, auditing existing Subscriber-level accounts on affected sites is advisable to assess whether unauthorized metadata access has already occurred.
More in Broadstreet
View allThe Broadstreet WordPress plugin before 1.51.8 does not sanitise and escape a parameter before outputting it back in the
Missing authorization in Broadstreet Ads WordPress plugin through version 1.52.2 allows authenticated users to bypass ac
The Broadstreet WordPress plugin versions up to 1.53.1 exposes sensitive business information through an unauthenticated
Stored Cross-Site Scripting in Broadstreet plugin for WordPress versions up to 1.53.1 allows authenticated administrator
Broadstreet WordPress plugin up to version 1.53.1 allows authenticated attackers with Subscriber-level access to create
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today