Broadstreet Ads WordPress plugin contains a Cross‑Site Request Forgery flaw (CWE‑352) that allows a malicious actor, who tricks a logged‑in user into visiting a forged URL, to modify the plugin’s configuration settings. The attacker cannot obtain credentials or execute arbitrary code, but can alter advertising behavior, potentially causing revenue loss or degrading user experience.

The vulnerability affects every installation of the Broadstreet Ads WordPress plugin up to and including version 1.52.1. Users of older or unpatched versions should verify the current plugin version and plan a timely upgrade.

The CVSS score of 4.3 and an EPSS score of less than 1 % place this issue in the low‑to‑medium severity range, and it is not listed in the CISA KEV catalog. A typical exploitation path requires a victim who is logged into the WordPress administrator interface to unknowingly follow a crafted link; because the attack works through the user’s browser, it does not need direct access to the server, but it relies on social‑engineering tactics.