CVE-2026-108092 pr-gateway CVE debrief

Who should care

WordPress site administrators and security teams should assess exposure and apply patches. Contributors and above with access to the affected plugin should be aware of the potential for unauthorized post access.

Why it matters

CVE-2026-108092 is a medium-severity vulnerability in the Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress. It allows authenticated attackers with Contributor-level access to read the title and content of any post, including private and pending posts. WordPress site administrators and security teams should assess exposure and apply patches. Contributors and above with access to the affected plugin should be aware of the potential for unauthorized post access.

• Potential unauthorized access to sensitive post content.
• Possible data exposure for private and pending posts.
• Need for verification of patch application and vulnerability remediation.
• Potential for monitoring and detection of suspicious post access activity.

Technical summary

The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers lacking per-object authorization on the postId parameter. This makes it possible for authenticated attackers with Contributor-level access and above to read the title and content of any post, including private and pending posts belonging to other users.

Defensive priority

Medium priority for WordPress site administrators and security teams to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the Blog2Social – Social Media Auto Post & Scheduler plugin version is 9.1.4 or earlier.
• Verify if Contributor-level access or higher is present in the WordPress environment.
• Apply patches or updates provided by the vendor to fix the vulnerability.
• Monitor for suspicious activity related to post access and content retrieval.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is due to the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers lacking per-object authorization on the postId parameter. The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. Authenticated attackers with Contributor-level access and above can read the title and content of any post, including private and pending posts belonging to other users. Evidence is based on the CVE record and NVD detail

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.