Blog2Social CVE-2026-89029

Requires an authenticated WordPress account with the edit_posts capability (Contributor, Author, Editor, or Administrator role) on a site running Blog2Social before 9.1.0; the attacker sends requests to the b2s_get_select_mandant_user AJAX handler supplying arbitrary IDs in the owner parameter. Limiting factors: it is NOT remotely unauthenticated - a valid low-privileged login is needed, so risk is highest on sites allowing open/self registration or with many low-trust contributor accounts. Impact is limited to disclosure of user IDs, display names, and account existence; no data modification, code execution, or service disruption is possible.

This is a genuine but low-severity information-exposure issue, correctly rated CVSS 4.0 5.3 (Medium). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires authentication as a low-privileged user holding the edit_posts capability (Author/Contributor/Editor role) - this is NOT unauthenticated. Impact is confidentiality-only and LOW (VC:L, VI:N, VA:N): the attacker learns user IDs, display names, and account existence, but gains no write, code-execution, or availability impact. Exploitation status: no public exploit identified at time of analysis - VulnCheck published an advisory but no POC or KEV listing, and EPSS is not provided. There are no conflicting signals: description, CWE-639 (authorization bypass / IDOR on user data), and CVSS all align. This is a real, patch-worthy authorization defect but a low-priority one - useful for reconnaissance (e.g., harvesting valid usernames like the admin account to seed brute-force or phishing) rather than direct compromise. Note the input 'Authentication Bypass' tag is misleading: this requires authentication and is an authorization/enumeration flaw, not an auth bypass.

A low-privileged authenticated user (e.g., a Contributor or Author account, possibly obtained via open registration or a compromised low-tier account) sends crafted b2s_get_select_mandant_user AJAX requests iterating the owner parameter over user IDs. The handler resolves each ID to a display name without an authorization check, letting the attacker enumerate all WordPress accounts and confirm which IDs exist. No public POC is currently identified, but exploitation is trivial given the low complexity.