EUVD-2026-20125
GHSA-gx9c-69hc-cjmj
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Impact | This vulnerability presents moderate real-world risk despite the low CVSS score of 4.3. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates network-accessible attack surface, low complexity, and low privilege requirements (Subscriber role is the default user level for blog commenters and contributors). The integrity impact is limited (I:L) and confidentiality/availability are not affected, which correctly reflects that attackers can modify or delete posts but not exfiltrate data or fully deny service. However, CVSS underweights the practical business impact: in multi-author WordPress sites (common for agencies, publishers, and collaborative teams), a Subscriber-level attacker can disrupt editorial workflows, delete scheduled promotional content, or reschedule competitor announcements. The low attack complexity and no UI requirement make this exploitable at scale. EPSS probability is not provided in the input data, but the minimal barriers to exploitation (pre-authentication available to any user account) suggest elevated real-world probability compared to high-CVSS issues requiring admin access. The vulnerability is not listed as actively exploited by CISA KEV, and no public POC has been published as of the analysis data provided, reducing immediate threat but not eliminating concern given the simplicity of exploitation. |
| Exploit ScenarioDerived | An authenticated attacker with a free Subscriber account on a multi-author WordPress blog registers an account and logs in. Using browser developer tools or a simple HTTP client, the attacker sends AJAX requests to the Blog2Social endpoint with a modified 'b2s_id' parameter corresponding to another author's scheduled post (e.g., a competitor's promotional post scheduled for tomorrow). By changing the 'b2s_id' value from their own posts to another user's posts and calling the reschedule or delete function, the attacker successfully delays or removes the competitor's scheduled social media post without authentication validation. This requires only knowledge of valid post IDs (often sequential or discoverable through public post lists) and no UI interaction beyond standard AJAX calls, making it automatable for bulk attacks across multiple posts. No publicly available exploit POC has been reported, but the vulnerability is straightforward to weaponize given the low complexity and widespread deployment of Blog2Social among WordPress publishers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to 8.8.3 allow authenticated attackers with Subscriber-level access to modify, reschedule, or delete other users' scheduled social media posts through authorization bypass in AJAX handlers. The vulnerability stems from insufficient validation of user-controlled 'b2s_id' parameters before performing UPDATE and DELETE operations, enabling privilege escalation within multi-user WordPress environments. No public exploit code or active exploitation has been reported, but the low CVSS complexity and minimal authentication barrier (Subscriber role) make this a practical attack vector in shared hosting scenarios.
RemediationAI
Update Blog2Social: Social Media Auto Post & Scheduler to version 8.8.4 or later, which addresses the authorization bypass by implementing proper ownership validation on 'b2s_id' parameters in AJAX handlers. Users should navigate to WordPress Plugins > Installed Plugins, locate Blog2Social, and click Update if available; automatic updates can be enabled for future releases. Until patching is possible, site administrators can mitigate by restricting Subscriber-level user accounts via the WordPress user role editor plugin or by temporarily disabling Blog2Social if it is not actively in use. Refer to the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/f3eec9c6-fef9-4d6e-8328-51efb997c99c?source=cve) for additional technical details and verification of patch availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Blog2Social is a WordPress plugin that manages scheduled social media post distribution across multiple platforms. The vulnerability exists in AJAX handlers within the plugin's Post.php and related files (B2S/Post/Tools.php, B2S/Ship/Save.php, Loader.php) that process 'b2s_id' parameters identifying scheduled posts. The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), which occurs when the application accepts user-supplied identifiers to access resources without verifying ownership or permissions. The AJAX endpoints fail to implement ownership checks before executing UPDATE (reschedule/modify) and DELETE operations on the 'b2s_id' parameter, allowing any authenticated subscriber to operate on posts belonging to other users. The flaw affects all versions through 8.8.3 of the plugin (CPE: cpe:2.3:a:pr-gateway:blog2social), with source code exposure visible in the WordPress plugin repository's browser links.
Know when Blog2Social gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up to, and including, 8.8.3. This is due to the plugin's AJAX handlers failing to validate that the user-supplied 'b2s_id' parameter belongs to the current user before performing UPDATE and DELETE operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify, reschedule, or delete other users' scheduled social media posts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Blog2Social
View allThe Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape
Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Post
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJA
The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sSh
The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. Rated medium seve
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSort
The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection. Rated critical severity (CVSS 9.8), thi
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). Rated medium severity (CVS
Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to 8.9.0 allows authenticated attackers
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi
Exploit-DB