CVE-2025-69311CWE-862

WordPress Broadstreet Ads plugin <= 1.52.1 - Broken Access Control vulnerability

High · published January 22, 2026

CVSS v3.1
7.6
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

⚡ Missing authorization in Broadstreet Ads can leave the door wide open for unauthorized access! Think of it like a restaurant with no bouncer; anyone can walk into the VIP section without a reservation. 🥳 This oversight in access control means attackers can waltz right into areas they shouldn't be in! An attacker exploiting this flaw could gain control over sensitive advertising data, potentially revealing private information or manipulating ad content. This could lead to reputational damage and financial loss as rivals capitalize on compromised data.

Put simply

Think of it like a restaurant with no bouncer; anyone can walk into the VIP section without a reservation. 🥳 This oversight in access control means attackers can waltz right into areas they shouldn't be in! This vulnerability stems from improperly configured access control levels in Broadstreet Ads, allowing unauthorized users to access restricted areas of the system, effectively bypassing security checks that should be in place.

What to do

An attacker exploiting this flaw could gain control over sensitive advertising data, potentially revealing private information or manipulating ad content. This could lead to reputational damage and financial loss as rivals capitalize on compromised data. Update to Broadstreet Ads version 1.52.2 or later to patch this vulnerability and ensure proper access controls are in place. Additionally, conduct a thorough review of your access control configurations to prevent similar issues. You've got this! With these steps, you'll have your defenses up and running in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-22T16:52Z
EPSS history
Timeline
  • 22 JAN 16:52Z
    WordPress Broadstreet Ads plugin <= 1.52.1 - Broken Access Control vulnerability
    cvelistv5