CVE-2026-1881
Deferred Deferred - Pending Action

Insecure Direct Object Reference in Broadstreet WordPress Plugin

Publication date: 2026-05-21

Last updated on: 2026-05-21

Assigner: Wordfence

Description
The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disclose any private post metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-05-21
Last Modified
2026-05-21
Generated
2026-06-30
AI Q&A
2026-05-21
EPSS Evaluated
2026-06-29
NVD
CVE-2026-1881
EUVD
EUVD-2026-31206

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
broadsstreet plugin to 1.52.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Broadstreet plugin for WordPress has a vulnerability called Insecure Direct Object Reference (IDOR) in all versions up to and including 1.52.2. This occurs via the get_sponsored_meta AJAX action because it lacks proper validation on a user-controlled key.

This flaw allows authenticated users with Subscriber-level access or higher to access private post metadata that they should not be able to see.

Impact Analysis

This vulnerability can lead to unauthorized disclosure of private post metadata within a WordPress site using the Broadstreet plugin. Even users with low-level access (Subscribers) can exploit this to view sensitive information that is meant to be private.

Such unauthorized data exposure can compromise confidentiality and potentially lead to further security issues depending on the nature of the private metadata disclosed.

Compliance Impact

The vulnerability allows authenticated attackers with Subscriber-level access to disclose any private post metadata due to missing validation in the Broadstreet WordPress plugin. This unauthorized disclosure of private data could potentially lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1881. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart