CVE-2026-4330
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Missing authorization in the Blog2Social plugin for WordPress (up to version 8.8.3). Authenticated attackers with Subscriber access can modify, reschedule, or delete other users' scheduled social media posts by manipulating the b2s_id parameter.
Risk Assessment
Possibility of unauthorized modification or deletion of social media content, potentially harming reputation and marketing strategy.
Recommendation
Update the Blog2Social plugin to the latest version.
Original NVD description (English source)
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up to, and including, 8.8.3. This is due to the plugin's AJAX handlers failing to validate that the user-supplied 'b2s_id' parameter belongs to the current user before performing UPDATE and DELETE operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify, reschedule, or delete other users' scheduled social media posts.