CVE-2025-9988

Executive Summary

CVE-2025-9988 is a Missing Authorization vulnerability in the Broadstreet WordPress plugin, affecting all versions up to and including 1.53.1. The flaw resides in the create_advertiser AJAX action, which fails to perform a capability check before processing requests. This allows authenticated attackers with Subscriber-level access or higher to create advertisers without proper permissions. The vulnerability has a CVSS score of 4.3 (Medium), with a low EPSS score of 0.0%, indicating no active exploitation in the wild at the time of analysis. No public proof-of-concept (PoC) or exploit code has been released.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Broadstreet plugin. Since it is a WordPress plugin, the supply chain risk is limited to sites that have installed this plugin. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated user with Subscriber-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – unauthorized creation of advertisers
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authentication, limiting the attack surface to users with existing accounts. However, Subscriber-level access is trivial to obtain on many WordPress sites (e.g., via registration). The impact is limited to creating advertisers, which may lead to spam or data pollution but not direct data theft or system compromise.

Deep Dive & Mechanics

The Broadstreet plugin registers an AJAX action create_advertiser for both authenticated and unauthenticated users. The vulnerable code does not verify that the current user has the required capability (e.g., edit_posts or manage_options) before executing the advertiser creation logic. This allows any authenticated user, including Subscribers, to call the action and create advertisers.

Root Cause: Missing capability check in the create_advertiser AJAX handler. The function likely uses wp_ajax_ and wp_ajax_nopriv_ hooks but fails to call current_user_can() or similar capability verification.

Attack Flow:

1. Attacker logs in with a Subscriber-level account.
2. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=create_advertiser and required parameters (e.g., advertiser name, email).
3. The server processes the request without checking if the user has permission to create advertisers.
4. A new advertiser is created in the database, potentially visible to other users or administrators.

Impact: Unauthorized creation of advertisers can lead to:

• Spam or malicious advertiser entries.
• Data pollution in the advertising system.
• Potential for further exploitation if advertiser data is used in other vulnerable functions.

Vulnerable vs. Patched Code

Since no official patch has been released, the following is a hypothetical fix based on best practices.

Vulnerable Code (hypothetical):

add_action('wp_ajax_create_advertiser', 'broadstreet_create_advertiser');
function broadstreet_create_advertiser() {
    // No capability check
    $name = sanitize_text_field($_POST['name']);
    $email = sanitize_email($_POST['email']);
    // ... create advertiser logic
    wp_die();
}

Patched Code (hypothetical):

add_action('wp_ajax_create_advertiser', 'broadstreet_create_advertiser');
function broadstreet_create_advertiser() {
    // Add capability check
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $name = sanitize_text_field($_POST['name']);
    $email = sanitize_email($_POST['email']);
    // ... create advertiser logic
    wp_die();
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with Broadstreet plugin version <= 1.53.1.
• A Subscriber-level account (e.g., username: attacker, password: password123).

Exploitation Steps:

1. Obtain a valid nonce for the AJAX action (if required). The nonce may be exposed in the page source or can be obtained by inspecting the plugin's JavaScript.
2. Send a POST request using curl:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
     -d "action=create_advertiser&name=MaliciousAdvertiser&email=attacker@example.com&_ajax_nonce=YOUR_NONCE" \
     --cookie "wordpress_logged_in_xxx=attacker_session_cookie"
   

3. Verify the advertiser was created by checking the plugin's admin interface or database.

Note: If no nonce is required, omit the _ajax_nonce parameter.

Blue Team (Defense & Detection)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=create_advertiser from low-privileged users.
• Look for unusual advertiser creation patterns (e.g., multiple advertisers created in a short time by the same user).

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-admin/admin-ajax.php" action=create_advertiser
| stats count by src_ip, user, uri
| where count > 5

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=create_advertiser from authenticated users with low privileges.
• Host:
  • Unexpected advertiser entries in the wp_broadstreet_advertisers table (or similar).
  • Log entries showing AJAX calls from Subscriber-level users to create_advertiser.
• File:
  • Modified or suspicious files in /wp-content/plugins/broadstreet/ (e.g., backdoored versions).

Detection Engineering

YARA Rule

rule CVE_2025_9988_Broadstreet_Missing_Auth
{
    meta:
        description = "Detects vulnerable Broadstreet plugin files with missing capability check"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9988"
    strings:
        $func = "create_advertiser" ascii wide nocase
        $ajax = "wp_ajax_" ascii wide nocase
        $nopriv = "wp_ajax_nopriv_" ascii wide nocase
        $cap_check = "current_user_can" ascii wide nocase
    condition:
        $func and $ajax and not $cap_check
}

Sigma Rule

title: CVE-2025-9988 - Broadstreet Plugin Missing Authorization
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects AJAX requests to create_advertiser without proper capability check
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "action=create_advertiser"
        cs-method: "POST"
    condition: selection
falsepositives:
    - Legitimate administrator actions
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-9988 - Broadstreet Plugin Missing Authorization Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=create_advertiser"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Broadstreet plugin until a patch is available.
2. Restrict user registration to prevent Subscriber-level accounts from being created.
3. Monitor logs for suspicious AJAX requests to create_advertiser.

Long-term Fix:

• Apply a custom patch by adding a capability check (e.g., current_user_can('edit_posts')) to the create_advertiser AJAX handler.
• Update to a patched version once released by the vendor.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to admin-ajax.php with action=create_advertiser from non-admin users.

Valters IT
Securing Digital Frontiers