The Broadstreet Ads plugin for WordPress suffers from a missing authorization control that allows users to exploit incorrectly configured security levels. An attacker who gains access to the plugin’s administrative interface can potentially read, modify, or delete advertising data or alter plugin settings. The weakness is classified as CWE‑862 and is a medium‑severity vulnerability with a CVSS score of 5.4. The exact exploitation vector is not specified, but it is likely tied to the plugin’s configuration and user privileges within WordPress.

This flaw affects the Broadstreet Ads WordPress plugin versions 1.52.2 and earlier. The vulnerable code resides in the Broadstreet Ads component of WordPress installations that have not upgraded beyond this version. No other vendors or products are listed.

With a CVSS score of 5.4, the vulnerability presents a moderate risk. Exploitation requires the attacker to interact with the WordPress site and potentially to have a user account with sufficient privileges to reach the plugin’s configuration pages. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. Nevertheless, the missing authorization layer could allow unauthorized users to tamper with advertising data or settings if they are able to log into the WordPress dashboard or inject requests that bypass normal permission checks.