Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disclose any private post metadata.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1881 The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX acti… https://www.cve.org/CVERecord?id=CVE-2026-1881
Post summary
The entry announces an IDOR vulnerability in the Broadstreet WordPress plugin up to version 1.52.2, targeted through an AJAX action, but provides no exploit or mitigation details.
🚨*CVE* CVE-2026-1881 The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX acti… https://www.cve.org/CVERecord?id=CVE-2026-1881 ----- Traducción: CVE-2026-1881 El … http://infoflow.cloud`
Post summary
The post announces CVE-2026-1881, an Insecure Direct Object Reference in the Broadstreet WordPress plugin affecting versions up to 1.52.2 via the get_sponsored_meta AJAX action, but provides no PoC, exploit, or remediation details.