The vulnerability is a missing authorization flaw that allows users to exploit incorrectly configured access control levels in the Broadstreet Ads WordPress plugin. An attacker who can reach the plugin’s administrative interface may view, modify, or delete advertising settings, potentially leading to data exposure, service disruption, or malicious advertising content. This is a classic broken access control weakness (CWE‑862).

WordPress sites using the Broadstreet Ads plugin version 1.52.1 or earlier are affected. The vulnerability applies to all installations that include the plugin regardless of the site’s configuration, as the flaw resides in the core plugin code rather than in specific settings.

The CVSS score of 7.6 classifies the flaw as high severity. With an EPSS score under 1 %, the likelihood of exploitation in the wild is currently low, and the vulnerability is not listed in the CISA KEV database. The likely attack vector is via any authenticated user who can access the plugin’s administration pages; if access control is not correctly enforced, even users with limited roles could exploit the bug. Attackers would need only the ability to reach the plugin’s management URLs, so the threat hinges on the weakness in role checks rather than on complex prerequisites.