Blog2Social CVE-2026-92829

Requires an authenticated WordPress account with contributor-level role or above on a site running Blog2Social <=9.1.0; no admin rights, no user interaction from the victim, and no special plugin configuration are needed. The normal nonce mitigation does not limit exploitation because b2s_security_nonce is exposed on the post-edit meta box that Contributors can already render. The practical limiting factor is the PR:L requirement - the site must grant contributor/author accounts to attackers (i.e. a multi-author or membership site); single-operator blogs where only the admin has accounts are not realistically exploitable.

This is a genuine but modest-severity authorization flaw (CWE-862, missing authorization) whose CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N = 4.3) is internally inconsistent with its own description: the description explicitly states the flaw allows 'disclosing another user's network authentication IDs and scheduled post content,' which is a real confidentiality impact, yet NVD scored C:N. I assess C:L is more accurate, raising the score to ~5.4. Exploitation requires an authenticated account at contributor level or above (PR:L), which the plugin itself weakens because the b2s_security_nonce is emitted on the post-edit meta box that Contributors can render - so the usual nonce protection provides no meaningful barrier at that role level. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this is not a widespread-exploitation priority. The realistic risk is confined to multi-author WordPress sites that grant contributor/author accounts to semi-trusted users; on single-admin blogs the PR:L prerequisite is rarely met. Net: a real, legitimate multi-tenant IDOR-class issue worth patching promptly on collaborative sites, but not an internet-wide emergency.

On a multi-author WordPress site running Blog2Social <=9.1.0, a user with a contributor account logs in, opens the post editor to harvest the b2s_security_nonce rendered in the meta box, then issues crafted AJAX requests (e.g. to includes/Ajax/Post.php or Get.php handlers) referencing other users' record IDs. This lets them read another author's stored social-network authentication IDs and scheduled post content, overwrite Open Graph/Twitter Card metadata on posts they don't own, rebind another user's social authorization, and mass-hide every user's scheduled posts. No public exploit code is identified, but the attack is trivial to script given the disclosed source-line references.