CVE-2026-108092 is a vulnerability in the Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress, allowing authenticated attackers with Contributor-level access to read the title and content of any post, including private and pending posts. The vulnerability arises from the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers lacking per-object authorization on the postId parameter. Wor [truncated]
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to view, modify, or delete other users' Blog2Social records, i [truncated]
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up to, and including, 8.8.3. This is due to the plugin's AJAX handlers failing to validate that the user-supplied 'b2s_id' parameter belongs to the current user before performing UPDATE and DELETE operations. This makes it possible for authenticated att [truncated]
