CVE-2026-1881 is an authorization bypass vulnerability (CWE-639) in the Broadstreet WordPress plugin affecting all versions up to 1.52.2. The issue arises from missing validation on a user-controlled key in the get_sponsored_meta AJAX action, enabling authenticated users with low privileges (Subscriber or above) to disclose private post metadata. The vulnerability is network exploitable with low attack complexity and does not require user interaction. Confidentiality impact is limited to information disclosure; integrity and availability are not affected. No vendor patch or official remediation level is documented as of the publication date.

An attacker with at least Subscriber-level access to a WordPress site using the vulnerable Broadstreet plugin can disclose private post metadata that should otherwise be restricted. This could lead to unauthorized exposure of sensitive information stored in post metadata. There is no indication of impact on data integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider restricting Subscriber-level access or disabling the Broadstreet plugin if private post metadata confidentiality is critical. Monitoring for updates from the vendor is recommended.