Blog2Social CVE-2026-89031

Requires an authenticated WordPress account holding the edit_posts capability (Contributor role or higher) on a site running Blog2Social before 9.1.0 - so the site must allow multiple/low-trust registered authors for cross-user impact to be meaningful. Exploitation is remote over HTTP with no user interaction, but is gated by that low-privilege authentication and by the presence of other users' scheduled social posts to target. Impact is limited to integrity/availability of scheduled social-media post records (reschedule, suppress, or alter publication state); no data disclosure. On single-author sites the practical cross-user risk is negligible.

This is a genuine but moderate-severity issue, correctly rated CVSS 4.0 5.3 (Medium). The vendor vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L is well-calibrated to the described flaw: a broken-access-control (IDOR/CWE-639) bug with integrity/availability impact on scheduled-post records and no confidentiality loss. The PR:L requirement is the key limiter - the attacker must already hold a valid account with the edit_posts capability (Contributor/Author/Editor), so this is a privilege-escalation-within-authenticated-users problem, not a pre-auth compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation; treat this as a routine patch-cycle item rather than an emergency. No conflicting signals were found between the CVSS vector and the description - both consistently describe an authenticated, low-privilege, remote, integrity-affecting bug. The one metadata discrepancy is the 'Authentication Bypass' tag, which mischaracterizes the flaw: the attacker IS authenticated, and the defect is missing authorization (ownership check), not an authentication bypass.

A registered low-privilege user (e.g., a Contributor with edit_posts) on a WordPress site running Blog2Social sends a crafted b2s_calendar_move_post AJAX request supplying another user's b2s_id. Because the UPDATE against b2s_posts is keyed only on that attacker-controlled primary key with no blog_user_id ownership constraint, the request reschedules, suppresses, or alters the publication state of a victim's queued social media post. No public exploit code was identified at time of analysis, though the attack is trivial to script given the documented handler and parameter.