Pr Gateway
Monthly
Authenticated Contributor-level users on WordPress sites running Blog2Social up to 9.1.4 can read arbitrary post titles and content, including private and pending posts owned by other users, through an insecure direct object reference in the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers. The flaw is a low-severity information disclosure (CVSS 4.3, CWE-639) that requires a valid Contributor account; no public exploit identified at time of analysis and no confirmed active exploitation. It matters most on multi-author, membership, or guest-contributor sites where Contributor accounts are broadly assigned, because single-author installs expose little or no data beyond what the attacker can already see.
Authorization bypass in the Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress (all versions through 9.1.0) allows any authenticated user holding Contributor-level access or higher to act on other users' social-media scheduling data, including viewing, modifying, or deleting records. Because the plugin's b2s_security_nonce is rendered on the post-edit meta box that Contributors can already access, the nonce does not function as a privilege barrier, so attackers can read another user's network authentication IDs and scheduled post content, overwrite Open Graph and Twitter Card metadata on posts they do not own, rebind another user's social-network authorization, and mass-hide scheduled posts sitewide. Exploitation requires a low-privileged account on a site running the affected plugin; no public exploit code has been identified at time of analysis, and no CISA KEV entry is associated with this CVE. Practical exposure is limited to multi-author or membership sites that grant Contributor or higher roles to untrusted users.
Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to 8.9.0 allows authenticated attackers to delete any user's published and scheduled social media post records due to missing ownership verification in the deleteUserPublishPost() and deleteUserSchedPost() functions. Attackers can supply arbitrary sequential post IDs to permanently soft-delete other users' B2S post records, disrupting content publishing workflows across multiuser WordPress installations. This vulnerability requires valid WordPress user authentication but no elevated privileges.
Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to 8.8.3 allow authenticated attackers with Subscriber-level access to modify, reschedule, or delete other users' scheduled social media posts through authorization bypass in AJAX handlers. The vulnerability stems from insufficient validation of user-controlled 'b2s_id' parameters before performing UPDATE and DELETE operations, enabling privilege escalation within multi-user WordPress environments. No public exploit code or active exploitation has been reported, but the low CVSS complexity and minimal authentication barrier (Subscriber role) make this a practical attack vector in shared hosting scenarios.
The Blog2Social plugin for WordPress contains an authorization flaw in the resetSocialMetaTags() function that allows authenticated attackers with Subscriber-level access to permanently delete all social media metadata from the site's post records. The vulnerability exists in all versions up to and including 8.8.2 and affects sites using the Blog2Social: Social Media Auto Post & Scheduler plugin, which is available via the WordPress plugin repository. Attackers can exploit this by crafting AJAX requests with a valid nonce that is broadly available due to the plugin granting the 'blog2social_access' capability to all user roles upon activation, resulting in complete data loss of social media scheduling information across all posts.
Authenticated Contributor-level users on WordPress sites running Blog2Social up to 9.1.4 can read arbitrary post titles and content, including private and pending posts owned by other users, through an insecure direct object reference in the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers. The flaw is a low-severity information disclosure (CVSS 4.3, CWE-639) that requires a valid Contributor account; no public exploit identified at time of analysis and no confirmed active exploitation. It matters most on multi-author, membership, or guest-contributor sites where Contributor accounts are broadly assigned, because single-author installs expose little or no data beyond what the attacker can already see.
Authorization bypass in the Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress (all versions through 9.1.0) allows any authenticated user holding Contributor-level access or higher to act on other users' social-media scheduling data, including viewing, modifying, or deleting records. Because the plugin's b2s_security_nonce is rendered on the post-edit meta box that Contributors can already access, the nonce does not function as a privilege barrier, so attackers can read another user's network authentication IDs and scheduled post content, overwrite Open Graph and Twitter Card metadata on posts they do not own, rebind another user's social-network authorization, and mass-hide scheduled posts sitewide. Exploitation requires a low-privileged account on a site running the affected plugin; no public exploit code has been identified at time of analysis, and no CISA KEV entry is associated with this CVE. Practical exposure is limited to multi-author or membership sites that grant Contributor or higher roles to untrusted users.
Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to 8.9.0 allows authenticated attackers to delete any user's published and scheduled social media post records due to missing ownership verification in the deleteUserPublishPost() and deleteUserSchedPost() functions. Attackers can supply arbitrary sequential post IDs to permanently soft-delete other users' B2S post records, disrupting content publishing workflows across multiuser WordPress installations. This vulnerability requires valid WordPress user authentication but no elevated privileges.
Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to 8.8.3 allow authenticated attackers with Subscriber-level access to modify, reschedule, or delete other users' scheduled social media posts through authorization bypass in AJAX handlers. The vulnerability stems from insufficient validation of user-controlled 'b2s_id' parameters before performing UPDATE and DELETE operations, enabling privilege escalation within multi-user WordPress environments. No public exploit code or active exploitation has been reported, but the low CVSS complexity and minimal authentication barrier (Subscriber role) make this a practical attack vector in shared hosting scenarios.
The Blog2Social plugin for WordPress contains an authorization flaw in the resetSocialMetaTags() function that allows authenticated attackers with Subscriber-level access to permanently delete all social media metadata from the site's post records. The vulnerability exists in all versions up to and including 8.8.2 and affects sites using the Blog2Social: Social Media Auto Post & Scheduler plugin, which is available via the WordPress plugin repository. Attackers can exploit this by crafting AJAX requests with a valid nonce that is broadly available due to the plugin granting the 'blog2social_access' capability to all user roles upon activation, resulting in complete data loss of social media scheduling information across all posts.