The Broadstreet WordPress plugin contains an insecure direct object reference flaw in its get_sponsored_meta AJAX action, allowing authenticated users with Subscriber level or higher to retrieve any private post metadata, effectively leaking information intended to be restricted. The weakness is identified by CWE-639.

WordPress sites that use the Broadstreet plugin version 1.52.2 or earlier are vulnerable, regardless of other plugins or theme configurations.

The vulnerability has a CVSS score of 4.3, indicating moderate severity. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog, suggesting limited known exploitation. Attacking requires simply authenticating with a subscriber or higher role and invoking the exposed AJAX endpoint, which is straightforward and incurs no significant effort.