Blog2Social EUVD-2026-101926

Exploitation requires an authenticated account with Contributor-level capability or higher on the target site (PR:L), reachable remotely via the plugin's admin-ajax endpoints. The affected site must run Blog2Social ≤9.1.4 and host posts owned by other users that the attacker wishes to read (the disclosure value exists only on multi-author, membership, or guest-contributor sites; single-author installs expose nothing new). No user interaction, no special non-default plugin configuration, and no victim action are needed - only invocation of the b2s_ship_item or b2s_ship_item_reload_url handlers with an arbitrary postId. The practical limiting factor is the Contributor-account prerequisite, which excludes purely anonymous attackers.

This is a genuine-but-low-priority authorization flaw, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) correctly reflects an Insecure Direct Object Reference (CWE-639): network-reachable and low-complexity, but requiring authenticated Contributor-level privileges (PR:L) and yielding only limited confidentiality impact (C:L) with no integrity or availability effect. No EPSS score, KEV listing, or SSVC decision data was supplied, and no public exploit is referenced, so there is no evidence of active or automatable exploitation. The practical ceiling of harm is reading the title and content of other users' private/pending posts - information disclosure within a multi-author site, not takeover. Net: a valid defense-in-depth fix worth patching on normal cadence, not an emergency. The main limiting factor is the PR:L requirement - an attacker must already hold a Contributor (or higher) account, which bounds the realistic threat to multi-author/membership sites rather than the general WordPress population.

An attacker who holds or registers a Contributor-level account on a multi-author WordPress site invokes the b2s_ship_item or b2s_ship_item_reload_url AJAX handler, substituting the postId parameter with the ID of a post they do not own. Because the handlers lack per-object authorization, the server returns the title and content of other users' private or pending posts. No public proof-of-concept is referenced; no public exploit identified at time of analysis.