What is the CVSS score of CVE-2026-7051?

CVE-2026-7051 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Blog2Social WordPress Plugin CVE-2026-7051

EUVD-2026-29899 MEDIUM

Missing Authorization (CWE-862)

2026-05-13 Wordfence

Authentication Bypass WordPress

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 05:31 vuln.today

CVE Published

May 13, 2026 - 04:26 nvd

MEDIUM 5.4

DescriptionCVE.org

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 8.9.0. This is due to a missing ownership verification in the B2S_Post_Tools::deleteUserPublishPost() and B2S_Post_Tools::deleteUserSchedPost() functions, neither function includes a blog_user_id constraint in its database query, allowing authenticated attackers to soft-delete any user's B2S post records by supplying arbitrary sequential wp_b2s_posts.id values via the 'postId' parameter. This makes it possible for authenticated attackers to delete other users' published and scheduled social media post records, disrupting content publishing workflows.

AnalysisAI

Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to 8.9.0 allows authenticated attackers to delete any user's published and scheduled social media post records due to missing ownership verification in the deleteUserPublishPost() and deleteUserSchedPost() functions. Attackers can supply arbitrary sequential post IDs to permanently soft-delete other users' B2S post records, disrupting content publishing workflows across multiuser WordPress installations. This vulnerability requires valid WordPress user authentication but no elevated privileges.

Technical ContextAI

Blog2Social is a WordPress plugin that automates social media content publishing and scheduling. The vulnerability exists in the B2S_Post_Tools class, specifically in the deleteUserPublishPost() and deleteUserSchedPost() methods, which process deletion requests via AJAX endpoints in the Post.php module. These functions query the wp_b2s_posts database table to remove post records but fail to include a blog_user_id constraint in their WHERE clauses, meaning any authenticated user can predict and delete post records belonging to other users by iterating through sequential post ID values. The root cause is a Missing Authorization weakness (CWE-862) where the function validates that a post exists but not whether the requesting user owns it. This is a classic horizontal privilege escalation in WordPress multiuser contexts.

RemediationAI

Update Blog2Social to a patched version released after 8.9.0. Wordfence advisory and plugin repository changeset references indicate a fix has been committed upstream. Until patching is possible, implement the following compensating controls: restrict WordPress user registration to trusted administrators only to minimize the number of authenticated users who can exploit this vulnerability; disable the Blog2Social plugin temporarily if content deletion is a critical business risk; or use WordPress role-based access control to limit author and editor capabilities to trusted staff only. Note that these workarounds do not fully mitigate the vulnerability if any non-admin authenticated user exists. Verify the patched version number from the official Blog2Social plugin repository or Wordfence advisory before deployment.