Is CVE-2025-9987 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-9987 being exploited in the wild.

How severe is CVE-2025-9987?

Medium severity, with a CVSS score of 5.3, published 13 May 2026.

Which products and versions are affected?

Broadstreet Up to, and including, 1.53.1.

Is there a fix for CVE-2025-9987?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-9987 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-9987?

Check whether you run Broadstreet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-9987: Broadstreet WordPress plugin sensitive information exposure in get_sponsored_meta

CVE-2025-9987 · Severity: medium · CVSS 5.3 · Published 2026-05-13

The Broadstreet plugin for WordPress, which is used for managing digital advertisements and sponsored content, contains a security flaw that allows unauthorized data access. An attacker with a basic user account can bypass normal restrictions to view sensitive business information and content that was intended to be private or password-protected. This could lead to the exposure of confidential business details or proprietary sponsored data.

Technologies: Broadstreet. Vendors: Broadstreet.

Quick answers

Is CVE-2025-9987 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-9987 being exploited in the wild.
How severe is CVE-2025-9987?: Medium severity, with a CVSS score of 5.3, published 13 May 2026.
Which products and versions are affected?: Broadstreet Up to, and including, 1.53.1.
Is there a fix for CVE-2025-9987?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-9987 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-9987?: Check whether you run Broadstreet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Broadstreet plugin for WordPress is vulnerable to sensitive information exposure due to an insecure implementation of the get_sponsored_meta() AJAX action. The vulnerability exists in all versions up to and including 1.53.1. The root cause is a lack of proper authorization checks or capability validation within the AJAX handler, allowing any authenticated user—including those with low-level 'subscriber' permissions—to trigger the function. By sending a crafted request to the WordPress AJAX endpoint, an attacker can retrieve metadata associated with sponsored content, including information from posts or business details that are marked as private or password-protected. A patch has been identified in recent changesets to address this unauthorized data access.

Affected products

Broadstreet Broadstreet Up to, and including, 1.53.1

Timeline

2026-05-13: disclosed: Initial publication of the vulnerability advisory.
2026-05-13: advisory: NVD and Wordfence published details regarding CVE-2025-9987.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.