EUVD-2026-16104Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a moderate but realistic security risk with several mitigating factors. The CVSS 3.1 score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) reflects the low attack complexity and network accessibility, but the requirement for authenticated access (PR:L) and limited impact scope limit the severity. The integrity and availability impacts are partial (I:L, A:N), indicating data loss rather than system compromise. While there is no indication of active exploitation in the wild or KEV status, the vulnerability is trivial to exploit once Subscriber credentials are obtained, and the attack requires no user interaction. The exploitation vector is highly automatable-any authenticated user can trigger the data deletion via a simple AJAX POST request. From an SSVC perspective, this is a real priority: the technical impact is direct (permanent data loss), the attack is easily automatable, and the exploitation sophistication is minimal. Organizations running Blog2Social should prioritize patching, especially those where Subscriber accounts are numerous or shared. The risk is elevated for multi-user WordPress sites where lower-privilege accounts exist. |
| Exploit ScenarioDerived | An attacker with Subscriber-level credentials (obtained through credential compromise, social engineering, or intentional account creation on a public-facing site) logs into the WordPress dashboard and navigates to any Blog2Social admin page where the b2s_security_nonce is output in the page HTML. The attacker then crafts a malicious AJAX POST request to /wp-admin/admin-ajax.php with action=resetSocialMetaTags, including the valid nonce extracted from the page. Due to the insufficient authorization check in the resetSocialMetaTags() function, which only verifies the 'read' capability and nonce validity without checking for higher-privilege operations, the request executes successfully and deletes all _b2s_post_meta records from the database. Within seconds, all social media scheduling metadata, posting history, and custom social media tags for every post on the site are permanently deleted, with no audit trail of the deletion. This is particularly damaging for content creators and social media managers who rely on the plugin's scheduling features. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
The Blog2Social plugin for WordPress contains an authorization flaw in the resetSocialMetaTags() function that allows authenticated attackers with Subscriber-level access to permanently delete all social media metadata from the site's post records. The vulnerability exists in all versions up to and including 8.8.2 and affects sites using the Blog2Social: Social Media Auto Post & Scheduler plugin, which is available via the WordPress plugin repository. Attackers can exploit this by crafting AJAX requests with a valid nonce that is broadly available due to the plugin granting the 'blog2social_access' capability to all user roles upon activation, resulting in complete data loss of social media scheduling information across all posts.
RemediationAI
Immediately upgrade the Blog2Social plugin to version 8.8.3 or later, which contains the necessary authorization checks to prevent unauthorized data deletion. Site administrators should navigate to the WordPress Dashboard, access Plugins > Installed Plugins, locate Blog2Social, and click the update button if available; if automatic updates are not enabled, manual download from the WordPress plugin repository is recommended. Until patching is completed, administrators should consider temporarily restricting Subscriber-level access to WordPress for non-essential users, reducing the attack surface for this vulnerability. Additionally, implement regular backups of the wp_postmeta table to enable recovery in case unauthorized deletion occurs. For sites that cannot immediately patch, implementing Web Application Firewall (WAF) rules to block AJAX requests to the vulnerable endpoint (/wp-admin/admin-ajax.php with action=resetSocialMetaTags) provides temporary mitigation. Refer to the Wordfence threat intelligence report for additional technical details: https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc46bc4-ecfb-438f-b951-7b957489cd96
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Blog2Social plugin (CPE: cpe:2.3:a:pr-gateway:blog2social:_social_media_auto_post_&_scheduler:*:*:*:*:*:*:*:*) implements an AJAX endpoint in includes/Ajax/Post.php that handles the resetSocialMetaTags() function. The vulnerability is rooted in CWE-862 (Missing Authorization), a weakness where the plugin performs insufficient access control checks before executing a privileged operation. Specifically, the function only verifies that the user possesses the 'read' capability and holds a valid b2s_security_nonce, both of which are available to Subscriber-level users due to the plugin's overly permissive grant of the 'blog2social_access' capability to all WordPress roles during activation. The vulnerable code paths are located at includes/Ajax/Post.php lines 37, 1281, and 1290, and the capability assignment occurs in includes/Loader.php line 2202. This design flaw allows the plugin to output the security nonce on admin pages accessible to low-privileged users, enabling them to craft valid AJAX requests that delete all _b2s_post_meta records from the wp_postmeta table.
Know when Blog2Social gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags() function only verifying that the user has the 'read' capability and a valid b2s_security_nonce, both of which are available to Subscriber-level users, as the plugin grants 'blog2social_access' capability to all roles upon activation, allowing them to access the plugin's admin pages where the nonce is output. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all _b2s_post_meta records from the wp_postmeta table, permanently removing all custom social media meta tags for every post on the site.
Executive ViewAI
Organizations using for WordPress is vulnerable to unauthorized data loss in all should be aware of moderate risk from CVE-2026-4331, a missing authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in WordPress Plugin Authorization Flaws
View all 3More in Blog2Social
View allThe Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape
Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Post
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJA
The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sSh
The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. Rated medium seve
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSort
The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection. Rated critical severity (CVSS 9.8), thi
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). Rated medium severity (CVS
Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to 8.9.0 allows authenticated attackers
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi
GitHub PoC
Exploit-DB