CVE-2026-1881 — The Broadstreet plugin for WordPress is vulnerable to

title: CVE-2026-1881 - Broadstreet Plugin Insecure Direct Object Reference
id: scw-2026-05-21-ai-1
status: experimental
level: medium
description: |
  Detects attempts to exploit CVE-2026-1881 by targeting the get_sponsored_meta AJAX action in the Broadstreet WordPress plugin. This action is vulnerable to Insecure Direct Object Reference due to missing validation on a user-controlled key, allowing authenticated users with Subscriber-level access to potentially disclose private post metadata.
author: SCW Feed Engine (AI-generated)
date: 2026-05-21
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-1881/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/admin-ajax.php'
      cs-uri-query|contains:
          - 'action=get_sponsored_meta'
      cs-method|exact:
          - 'POST'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse