What the vulnerability does
01Description
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up to, and including, 8.8.3. This is due to the plugin's AJAX handlers failing to validate that the user-supplied 'b2s_id' parameter belongs to the current user before performing UPDATE and DELETE operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify, reschedule, or delete other users' scheduled social media posts.
Explanation of Vulnerability in Simple Terms
02Summary
Blog2Social versions up to 8.8.3 contain an authorization flaw that allows authenticated users to modify data they should not have access to. An attacker with a low-privilege account can alter content or settings through the plugin's API or interface. The vulnerability requires login credentials but no additional user interaction. Update to a version newer than 8.8.3 to remediate.
What an attacker can do
03Attacker Capabilities
Modify or alter plugin data and settings with a low-privilege user account.
Potential impact on your site
04Site Impact
Unauthorized users can change Blog2Social settings, scheduled posts, or social media configurations.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege user account on the WordPress site.
Key dates
06Disclosure timeline
April 8, 2026
CVE published
April 8, 2026
Record updated
