# CVE-2025-9987: Broadstreet WordPress plugin sensitive information exposure in get_sponsored_meta

Source: https://junglewise.ai/threats/cve-2025-9987-broadstreet-wordpress-plugin-sensitive-information-exposure-in-get  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2025-9987 · Severity: medium · CVSS 5.3 · Published 2026-05-13

The Broadstreet plugin for WordPress, which is used for managing digital advertisements and sponsored content, contains a security flaw that allows unauthorized data access. An attacker with a basic user account can bypass normal restrictions to view sensitive business information and content that was intended to be private or password-protected. This could lead to the exposure of confidential business details or proprietary sponsored data.

Technologies: [Broadstreet](https://junglewise.ai/threats/technologies/broadstreet). Vendors: [Broadstreet](https://junglewise.ai/threats/vendors/broadstreet).

## Quick answers

**Is CVE-2025-9987 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-9987 being exploited in the wild.

**How severe is CVE-2025-9987?** Medium severity, with a CVSS score of 5.3, published 13 May 2026.

**Which products and versions are affected?** Broadstreet Up to, and including, 1.53.1.

**Is there a fix for CVE-2025-9987?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-9987 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-9987?** Check whether you run Broadstreet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Broadstreet plugin for WordPress is vulnerable to sensitive information exposure due to an insecure implementation of the get_sponsored_meta() AJAX action. The vulnerability exists in all versions up to and including 1.53.1. The root cause is a lack of proper authorization checks or capability validation within the AJAX handler, allowing any authenticated user—including those with low-level 'subscriber' permissions—to trigger the function. By sending a crafted request to the WordPress AJAX endpoint, an attacker can retrieve metadata associated with sponsored content, including information from posts or business details that are marked as private or password-protected. A patch has been identified in recent changesets to address this unauthorized data access.

## Affected products

- Broadstreet Broadstreet Up to, and including, 1.53.1

## Timeline

- 2026-05-13: disclosed: Initial publication of the vulnerability advisory.
- 2026-05-13: advisory: NVD and Wordfence published details regarding CVE-2025-9987.

## References

- [https://plugins.trac.wordpress.org/changeset/3524817](https://plugins.trac.wordpress.org/changeset/3524817)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/b3cc3835-25f5-43b3-82be-397b8b3bd369?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/b3cc3835-25f5-43b3-82be-397b8b3bd369?source=cve)

## Related threats

- [Broadstreet WordPress plugin Stored XSS in admin settings](https://junglewise.ai/threats/cve-2025-9989-broadstreet-wordpress-plugin-stored-xss-in-admin-settings)
- [Broadstreet WordPress plugin improper authorization in create_advertiser](https://junglewise.ai/threats/cve-2025-9988-broadstreet-wordpress-plugin-improper-authorization-in-create)