EUVD-2026-80772
GHSA-78j3-qgmg-rvq3
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a genuine but modest-severity information-disclosure issue, not a high-impact priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N, score 5.3) is consistent with the description: remote, low-complexity, but requiring an authenticated low-privileged account (PR:L, matching the stated edit_posts capability) and yielding only limited confidentiality impact (VC:L) - email addresses, with no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active or imminent exploitation. The realistic risk is that this is a broken-access-control (CWE-862) flaw useful for reconnaissance/harvesting on multi-author WordPress sites rather than a standalone critical bug. Note a labeling conflict: the 'Authentication Bypass' tag overstates the issue - CVSS PR:L and CWE-862 indicate an authenticated authorization failure, not a bypass of authentication. Prioritize patching where untrusted contributors/authors have accounts; deprioritize on single-admin sites where no low-privileged users exist. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
User email disclosure in Adenion's Blog2Social WordPress plugin before 9.1.0 allows any authenticated user holding the edit_posts capability to enumerate and retrieve the email addresses of every registered account on the site, including administrators. The b2s_search_user AJAX handler fails to restrict callers to those with the list_users capability, turning a routine user-search function into a bulk contact-harvesting primitive for low-privileged insider or subscriber-level accounts. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the practical risk is data-harvesting and follow-on phishing rather than code execution, so this is a genuine but modest-severity information-disclosure issue rather than a high-impact priority.
RemediationAI
Upgrade Blog2Social to version 9.1.0 or later - the vendor-released patch is available per the WordPress.org plugin developer/changelog page (https://wordpress.org/plugins/blog2social/#developers) and the VulnCheck advisory - and confirm the update has propagated to every site in the estate, including multisite networks where plugin versions can diverge per site. If immediate updating is not possible, deploy a compensating control that neutralises the specific action: block or reject requests to admin-ajax.php carrying action=b2s_search_user at the WAF or reverse proxy, accepting the trade-off that legitimate plugin user-search functionality (for example in the social-posting assignment UI) will break while the rule is active; alternatively, tighten role assignments by auditing and removing the edit_posts capability from any untrusted or low-trust accounts and avoiding Contributor-level access for external or unvetted users, though this is only a partial mitigation because any account that legitimately needs publishing rights will still be able to reach the endpoint. Because the flaw is an authorization omission rather than an input-validation bug, there is no configuration toggle inside the plugin that disables the leak, and blocking the action is the only effective interim measure; treat exposed email addresses as compromised data and consider notifying affected administrators given the phishing risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Blog2Social is a WordPress social-media auto-posting and scheduling plugin published by Adenion; the affected component is its AJAX surface, which in WordPress is exposed through admin-ajax.php and dispatched by wp_ajax_* / wp_ajax_nopriv_* hooks. The b2s_search_user action registered in includes/Ajax/Get.php forwards the request to B2S_Tools::searchUser() in includes/Tools.php, which performs a user lookup and returns matching records including the user_email field. The root cause is CWE-862 (Missing Authorization): the handler never verifies that the caller holds the list_users capability - the capability WordPress itself uses to gate access to the user administration screens and email data - so any logged-in user whose role grants edit_posts (Contributor and above, a very common configuration on multi-author sites) can invoke the endpoint and receive administrator email addresses. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) confirms a network-reachable, low-privilege-authenticated, no-interaction attack with limited confidentiality impact only and no integrity or availability effect, consistent with a straightforward authorization-check omission rather than a memory-safety or injection flaw. CPE cpe:2.3:a:adenion:blog2social:*:*:*:*:*:*:*:* covers all pre-9.1.0 releases of the plugin.
Know when Blog2Social gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2s_search_user AJAX handler in includes/Ajax/Get.php invokes B2S_Tools::searchUser() in includes/Tools.php, which returns the email address of every matching user without restricting access to callers holding the list_users capability, allowing any user with the edit_posts capability to retrieve user email addresses including those of administrators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Blog2Social
View allThe Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape
Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Post
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJA
The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sSh
The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. Rated medium seve
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSort
The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection. Rated critical severity (CVSS 9.8), thi
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). Rated medium severity (CVS
Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to 8.9.0 allows authenticated attackers
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi
Exploit-DB