Broadstreet WordPress Plugin Missing Authorization Vulnerability in Advertiser Creation

A vulnerability exists in the Broadstreet plugin for WordPress, allowing unauthorized access to the create_advertiser AJAX action. This issue affects all versions through 1.53.1. The vulnerability arises from a lack of capability checks, enabling authenticated attackers with Subscriber-level access and above to create advertisers.

Impact

Exploitation of this vulnerability allows for unauthorized creation of advertiser profiles, which could be misused for fraudulent activities or to manipulate advertising campaigns.

Remediation

Users can update to Broadstreet version 1.53.2 or a newer patched version to address this vulnerability.