Broadstreet WordPress Plugin Insecure Direct Object Reference Vulnerability Allowing Private Post Metadata Disclosure

A vulnerability exists in the Broadstreet plugin for WordPress, in all versions up to and including 1.52.2. The issue is an Insecure Direct Object Reference (IDOR) vulnerability, which arises from inadequate validation of user-controlled keys in the get_sponsored_meta AJAX action. This flaw enables authenticated attackers with Subscriber-level access and above to access and disclose private post metadata.

Impact

Exploitation of this vulnerability allows for unauthorized disclosure of private post metadata.

Remediation

Users are advised to update the Broadstreet WordPress plugin to version 1.53.2 or a newer patched version.