EUVD-2026-29899Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain WordPress user account
-
DeliveryAuthenticate to WordPress
-
ExploitDiscover sequential post IDs
-
ExecutionSend AJAX deletion request with arbitrary postId
-
PersistPlugin deletes post record without ownership check
-
ImpactTarget user's content removed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires valid WordPress user authentication (PR:L in CVSS vector) - an attacker must have an active WordPress user account on the target site with any role that can access the Blog2Social plugin interface (e.g., contributor, author, editor, or administrator). No special plugin configuration is required; the vulnerability exists in default Blog2Social installations. The attacker must know or guess sequential post IDs from the wp_b2s_posts table; ID enumeration is trivial since IDs are unsigned integers starting from 1. The B2S_Post_Tools functions are exposed via AJAX endpoints without additional authorization checks beyond basic WordPress authentication. Exploitation is blocked only if the Blog2Social plugin is disabled or user registration is restricted to fully trusted administrators. |
| Impact | CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) indicates network-accessible unauthorized modification and availability impact requiring low-privilege authenticated access with no user interaction. The vulnerability presents moderate real-world risk in environments with multiple WordPress user roles, particularly those with contributor, author, or editor permissions. Attack complexity is low because exploitation requires only sequential ID enumeration and AJAX requests, both trivial to automate. The integrity and availability impacts are limited to data deletion rather than data exposure or system compromise, but the attack affects user workflows and published content. In single-admin WordPress installations with restricted user registration, risk is minimal; in SaaS platforms or collaborative publishing environments with many users, risk is substantial. No EPSS, KEV, or public POC data provided, suggesting this is a newly disclosed vulnerability with limited active exploitation intelligence at the time of analysis. |
| Exploit ScenarioDerived | An authenticated WordPress contributor on a multiuser blog discovers through trial or documentation that post IDs are sequential. The attacker sends AJAX requests to the deleteUserSchedPost() endpoint with postId parameters belonging to other users' scheduled social media posts, obtained by incrementing ID values. The plugin processes the deletion request without verifying ownership, and the victim's post records are soft-deleted, preventing scheduled content from publishing. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 13, 2026
Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to 8.9.0 allows authenticated attackers to delete any user's published and scheduled social media post records due to missing ownership verification in the deleteUserPublishPost() and deleteUserSchedPost() functions. Attackers can supply arbitrary sequential post IDs to permanently soft-delete other users' B2S post records, disrupting content publishing workflows across multiuser WordPress installations. This vulnerability requires valid WordPress user authentication but no elevated privileges.
RemediationAI
Update Blog2Social to a patched version released after 8.9.0. Wordfence advisory and plugin repository changeset references indicate a fix has been committed upstream. Until patching is possible, implement the following compensating controls: restrict WordPress user registration to trusted administrators only to minimize the number of authenticated users who can exploit this vulnerability; disable the Blog2Social plugin temporarily if content deletion is a critical business risk; or use WordPress role-based access control to limit author and editor capabilities to trusted staff only. Note that these workarounds do not fully mitigate the vulnerability if any non-admin authenticated user exists. Verify the patched version number from the official Blog2Social plugin repository or Wordfence advisory before deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Blog2Social is a WordPress plugin that automates social media content publishing and scheduling. The vulnerability exists in the B2S_Post_Tools class, specifically in the deleteUserPublishPost() and deleteUserSchedPost() methods, which process deletion requests via AJAX endpoints in the Post.php module. These functions query the wp_b2s_posts database table to remove post records but fail to include a blog_user_id constraint in their WHERE clauses, meaning any authenticated user can predict and delete post records belonging to other users by iterating through sequential post ID values. The root cause is a Missing Authorization weakness (CWE-862) where the function validates that a post exists but not whether the requesting user owns it. This is a classic horizontal privilege escalation in WordPress multiuser contexts.
Know when Blog2Social gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 8.9.0. This is due to a missing ownership verification in the B2S_Post_Tools::deleteUserPublishPost() and B2S_Post_Tools::deleteUserSchedPost() functions, neither function includes a blog_user_id constraint in its database query, allowing authenticated attackers to soft-delete any user's B2S post records by supplying arbitrary sequential wp_b2s_posts.id values via the 'postId' parameter. This makes it possible for authenticated attackers to delete other users' published and scheduled social media post records, disrupting content publishing workflows.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Blog2Social
View allThe Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape
Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Post
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJA
The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sSh
The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. Rated medium seve
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSort
The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection. Rated critical severity (CVSS 9.8), thi
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). Rated medium severity (CVS
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure
GitHub PoC
Exploit-DB