CVE-2025-9988: Unauthorized Access in Broadstreet WordPress Plugin
Plattform
wordpress
Komponente
broadstreet
Behoben in
1.53.2
CVE-2025-9988 affects the Broadstreet WordPress plugin, allowing authenticated attackers with Subscriber-level access or higher to create advertisers. This vulnerability stems from a missing capability check within the create_advertiser AJAX action. Affected versions include those prior to 1.53.2, and a patch is available in version 1.53.2.
Erkenne diese CVE in deinem Projekt
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Auswirkungen und Angriffsszenarien
The primary impact of CVE-2025-9988 is the potential for unauthorized content publication. An attacker, already logged in with a Subscriber role (or higher), can leverage this vulnerability to create new advertisers within the Broadstreet plugin. This could lead to the injection of malicious advertisements, spam content, or other unauthorized material onto the website. While the attacker needs to be authenticated, the relatively low access requirements (Subscriber role) significantly broaden the potential attack surface. The blast radius is limited to the website using the vulnerable Broadstreet plugin, but the consequences can be substantial if the injected content damages the site's reputation or compromises user data.
Ausnutzungskontext
CVE-2025-9988 is not currently listed on KEV or EPSS, suggesting a low to medium probability of active exploitation. Public proof-of-concept (POC) code is not widely available as of the publication date. While no active campaigns have been publicly reported, the ease of exploitation (requiring only authenticated access) warrants vigilance. The vulnerability was published on 2026-05-13.
Bedrohungsanalyse
Exploit-Status
CISA SSVC
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Netzwerk — aus der Ferne über das Internet ausnutzbar. Kein physischer oder lokaler Zugriff erforderlich.
- Attack Complexity
- Niedrig — keine besonderen Bedingungen erforderlich. Zuverlässig ausnutzbar.
- Privileges Required
- Niedrig — jedes gültige Benutzerkonto ist ausreichend.
- User Interaction
- Keine — automatischer und lautloser Angriff. Das Opfer tut nichts.
- Scope
- Unverändert — Auswirkung auf das anfällige Komponente beschränkt.
- Confidentiality
- Keine — kein Vertraulichkeitseinfluss.
- Integrity
- Niedrig — Angreifer kann einige Daten mit begrenztem Umfang ändern.
- Availability
- Keine — kein Verfügbarkeitseinfluss.
Betroffene Software
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Reserved
- Veröffentlicht
Mitigation und Workarounds
The recommended mitigation for CVE-2025-9988 is to immediately upgrade the Broadstreet plugin to version 1.53.2 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider temporarily restricting access to the createadvertiser AJAX endpoint using a WordPress firewall (WAF) or security plugin. Specifically, configure the WAF to block requests to /wp-admin/admin-ajax.php?action=createadvertiser from users with the Subscriber role. Regularly review user roles and permissions to ensure that only authorized personnel have access to administrative functions. After upgrading, confirm the fix by attempting to create an advertiser with a Subscriber-level user account; the action should be denied.
So beheben
Aktualisieren Sie auf Version 1.53.2 oder eine neuere gepatchte Version
Häufig gestellte Fragen
What is CVE-2025-9988 — Unauthorized Access in Broadstreet WordPress Plugin?
CVE-2025-9988 is a medium severity vulnerability in the Broadstreet WordPress plugin allowing authenticated users (Subscriber level or higher) to create advertisers without proper authorization.
Am I affected by CVE-2025-9988 in Broadstreet WordPress Plugin?
You are affected if you are using Broadstreet WordPress plugin versions 0.0 through 1.53.1. Upgrade to version 1.53.2 or later to mitigate the risk.
How do I fix CVE-2025-9988 in Broadstreet WordPress Plugin?
The fix is to upgrade the Broadstreet WordPress plugin to version 1.53.2 or later. As a temporary workaround, restrict access to the create_advertiser AJAX endpoint using a WAF.
Is CVE-2025-9988 being actively exploited?
As of the publication date, there are no publicly reported active campaigns exploiting CVE-2025-9988, but the ease of exploitation warrants vigilance.
Where can I find the official Broadstreet advisory for CVE-2025-9988?
Refer to the official Broadstreet plugin documentation and WordPress plugin repository for the latest advisory and update information regarding CVE-2025-9988.
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Erkenne diese CVE in deinem Projekt
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Scannen Sie jetzt Ihr WordPress-Projekt – kein Konto
Laden Sie ein Manifest hoch (composer.lock, package-lock.json, WordPress Plugin-Liste…) oder fügen Sie Ihre Komponentenliste ein. Sie erhalten sofort einen Schwachstellenbericht. Das Hochladen einer Datei ist nur der Anfang: Mit einem Konto erhalten Sie kontinuierliche Überwachung, Slack/email-Benachrichtigungen, Multi-Projekt- und White-Label-Berichte.
Abhängigkeitsdatei hier ablegen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...