# CVE-2025-9988: Broadstreet WordPress plugin improper authorization in create_advertiser

Source: https://junglewise.ai/threats/cve-2025-9988-broadstreet-wordpress-plugin-improper-authorization-in-create  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2025-9988 · Severity: medium · CVSS 4.3 · Published 2026-05-13

The Broadstreet plugin for WordPress, which is used for managing digital advertisements, contains a security flaw that allows low-level users to perform unauthorized actions. Specifically, any logged-in user with basic 'Subscriber' permissions can create new advertiser profiles within the system. This could lead to unauthorized data entry and cluttering of the advertising management interface.

Technologies: [Broadstreet](https://junglewise.ai/threats/technologies/broadstreet). Vendors: [Broadstreet](https://junglewise.ai/threats/vendors/broadstreet).

## Quick answers

**Is CVE-2025-9988 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-9988 being exploited in the wild.

**How severe is CVE-2025-9988?** Medium severity, with a CVSS score of 4.3, published 13 May 2026.

**Which products and versions are affected?** Broadstreet up to, and including, 1.53.1.

**Is there a fix for CVE-2025-9988?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-9988 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-9988?** Check whether you run Broadstreet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Broadstreet plugin for WordPress fails to implement proper authorization checks on its 'create_advertiser' AJAX action. The vulnerability is classified as Improper Authorization (CWE-285) because the code lacks a 'current_user_can()' or similar capability check before processing the request. An authenticated attacker with minimal privileges, such as a Subscriber, can send a crafted AJAX request to the server to create new advertiser entries. This issue affects all versions of the plugin up to and including 1.53.1. A patch has been identified in the plugin's changeset 3524817.

## Affected products

- Broadstreet Broadstreet up to, and including, 1.53.1

## Timeline

- 2026-05-13: disclosed
- 2026-05-13: advisory

## References

- [https://plugins.trac.wordpress.org/changeset/3524817](https://plugins.trac.wordpress.org/changeset/3524817)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/480ab377-b979-4e1c-9c7a-cf63d69ad697?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/480ab377-b979-4e1c-9c7a-cf63d69ad697?source=cve)

## Related threats

- [Broadstreet WordPress plugin Stored XSS in admin settings](https://junglewise.ai/threats/cve-2025-9989-broadstreet-wordpress-plugin-stored-xss-in-admin-settings)
- [Broadstreet WordPress plugin sensitive information exposure in get_sponsored_meta](https://junglewise.ai/threats/cve-2025-9987-broadstreet-wordpress-plugin-sensitive-information-exposure-in-get)