5.4

CVE-2026-89031

Blog2Social WordPress Plugin < 9.1.0 Broken Access Control via b2s_calendar_move_post

Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 - Insecure Direct Object Reference

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s_posts table using only the attacker-supplied b2s_id primary key with no blog_user_id ownership constraint, allowing any user with the edit_posts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post.
Mögliche Gegenmaßnahme
Blog2Social: Social Media Auto Post & Scheduler: Update to version 9.1.0, or a newer patched version
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerAdenion
≫
Produkt Blog2Social
Default Statusunaffected
Version 0
Version < 9.1.0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Blog2Social: Social Media Auto Post & Scheduler
Version *-9.0.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.23% 0.144
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
disclosure@vulncheck.com 5.3 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
disclosure@vulncheck.com 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://wordpress.org/plugins/blog2social/#developers
https://www.vulncheck.com/advisories/blog2social-wordpress-plugin-broken-access-control-via-b2s-calendar-move-post
https://www.wordfence.com/threat-intel/vulnerabilities/id/1ff179fc-911d-4143-b2a2-5187d2aec67b
Third Party Advisory