CVE-2026-4330
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Missing authorization in the Blog2Social plugin for WordPress (up to version 8.8.3). Authenticated attackers with Subscriber access can modify, reschedule, or delete other users' scheduled social media posts by manipulating the b2s_id parameter.
Risk Assessment
Possibility of unauthorized modification or deletion of social media content, potentially harming reputation and marketing strategy.
Recommendation
Update the Blog2Social plugin to the latest version.
Other vulnerabilities in Blog2Social
See all- CVE-2026-89030Medium
The Blog2Social plugin for WordPress before version 9.1.0 exposes the email addresses of all registered users to low-privileged accounts. The b2s_search_user AJAX handler in includes/Ajax/Get.php calls B2S_Tools::searchUser() in includes/Tools.php, which returns the email address of every matching user without restricting access to callers holding the list_users capability, allowing any user with the edit_posts capability to retrieve user email addresses including those of administrators.
- CVE-2026-89029Medium
The Blog2Social plugin for WordPress before version 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller is authorized to read user account data, allowing any user with the edit_posts capability to map WordPress user IDs to display names and confirm account existence for arbitrary IDs.
- CVE-2026-56044High
The vulnerability allows an unauthenticated attacker to perform XSS attacks in Blog2Social version 8.9.2 and earlier. The attack can be carried out without authentication, increasing the risk of exploitation.
Original NVD description (English source)
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up to, and including, 8.8.3. This is due to the plugin's AJAX handlers failing to validate that the user-supplied 'b2s_id' parameter belongs to the current user before performing UPDATE and DELETE operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify, reschedule, or delete other users' scheduled social media posts.