Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-1881: Broadstreet WordPress Plugin Exposes Private Post Metadata

CVE-2026-1881 · published 5 months ago

Summary

The Broadstreet plugin for WordPress, in versions up to 1.52.2, allows attackers to access sensitive information about private posts. This is a concern because it could be used to gather confidential data. To protect your site, update the plugin to the latest version or remove it if you're not using it.

Original advisory text

The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disclose any private post metadata.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-639Authorization Bypass Through User-Controlled Key

Timeline

Published21 May 2026

Updated4 Nov 2026

First seen21 May 2026

Sources

CVE-2026-1881 · NVD

Track software like this

Free during beta