What is the CVSS score of CVE-2026-4331?

CVE-2026-4331 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4331?

Organizations using for WordPress is vulnerable to unauthorized data loss in all should be aware of moderate risk from CVE-2026-4331, a missing authorization vulnerability rated CVSS 4.3.

How to fix or mitigate CVE-2026-4331?

Within 30 days: Identify affected systems running for WordPress is vulnerable to unauthorized data loss in all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-4331

EUVD-2026-16104 MEDIUM

Missing Authorization (CWE-862)

2026-03-26 Wordfence

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 04:30 euvd

EUVD-2026-16104

Analysis Generated

Mar 26, 2026 - 04:30 vuln.today

CVE Published

Mar 26, 2026 - 03:37 nvd

MEDIUM 4.3

DescriptionCVE.org

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags() function only verifying that the user has the 'read' capability and a valid b2s_security_nonce, both of which are available to Subscriber-level users, as the plugin grants 'blog2social_access' capability to all roles upon activation, allowing them to access the plugin's admin pages where the nonce is output. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all _b2s_post_meta records from the wp_postmeta table, permanently removing all custom social media meta tags for every post on the site.

AnalysisAI

The Blog2Social plugin for WordPress contains an authorization flaw in the resetSocialMetaTags() function that allows authenticated attackers with Subscriber-level access to permanently delete all social media metadata from the site's post records. The vulnerability exists in all versions up to and including 8.8.2 and affects sites using the Blog2Social: Social Media Auto Post & Scheduler plugin, which is available via the WordPress plugin repository. Attackers can exploit this by crafting AJAX requests with a valid nonce that is broadly available due to the plugin granting the 'blog2social_access' capability to all user roles upon activation, resulting in complete data loss of social media scheduling information across all posts.

Technical ContextAI

The Blog2Social plugin (CPE: cpe:2.3:a:pr-gateway:blog2social:_social_media_auto_post_&_scheduler:*:*:*:*:*:*:*:*) implements an AJAX endpoint in includes/Ajax/Post.php that handles the resetSocialMetaTags() function. The vulnerability is rooted in CWE-862 (Missing Authorization), a weakness where the plugin performs insufficient access control checks before executing a privileged operation. Specifically, the function only verifies that the user possesses the 'read' capability and holds a valid b2s_security_nonce, both of which are available to Subscriber-level users due to the plugin's overly permissive grant of the 'blog2social_access' capability to all WordPress roles during activation. The vulnerable code paths are located at includes/Ajax/Post.php lines 37, 1281, and 1290, and the capability assignment occurs in includes/Loader.php line 2202. This design flaw allows the plugin to output the security nonce on admin pages accessible to low-privileged users, enabling them to craft valid AJAX requests that delete all _b2s_post_meta records from the wp_postmeta table.

RemediationAI

Immediately upgrade the Blog2Social plugin to version 8.8.3 or later, which contains the necessary authorization checks to prevent unauthorized data deletion. Site administrators should navigate to the WordPress Dashboard, access Plugins > Installed Plugins, locate Blog2Social, and click the update button if available; if automatic updates are not enabled, manual download from the WordPress plugin repository is recommended. Until patching is completed, administrators should consider temporarily restricting Subscriber-level access to WordPress for non-essential users, reducing the attack surface for this vulnerability. Additionally, implement regular backups of the wp_postmeta table to enable recovery in case unauthorized deletion occurs. For sites that cannot immediately patch, implementing Web Application Firewall (WAF) rules to block AJAX requests to the vulnerable endpoint (/wp-admin/admin-ajax.php with action=resetSocialMetaTags) provides temporary mitigation. Refer to the Wordfence threat intelligence report for additional technical details: https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc46bc4-ecfb-438f-b951-7b957489cd96