CVE-2025-9988: Broadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser Creation
The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the createadvertiser AJAX action in all versions up to, and including, 1.53.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create advertisers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9988?
CVE-2025-9988 has been assessed as a high severity vulnerability due to the potential for unauthorized access to advertiser creation.
How do I fix CVE-2025-9988?
To fix CVE-2025-9988, update the Broadstreet WordPress plugin to version 1.53.2 or later where the missing capability check is addressed.
Who is affected by CVE-2025-9988?
Users of the Broadstreet WordPress plugin in versions up to and including 1.53.1 are affected by CVE-2025-9988.
What does CVE-2025-9988 exploit?
CVE-2025-9988 exploits a missing authorization check in the create_advertiser AJAX action allowing unauthorized users to create advertisers.
Is CVE-2025-9988 a known vulnerability?
Yes, CVE-2025-9988 is a recognized vulnerability in the Broadstreet WordPress plugin that has been publicly disclosed.