MEDIUM 4.3 NVD
CVE-2026-108092
The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including
The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers lacking per-object authorization on the postId parameter. This makes it possible for authenticated attackers with Contributor-level access and above to read the title and content of any post, including private and pending posts belonging to other users.
References
- https://plugins.trac.wordpress.org/browser/blog2social/tags/9.1.4/includes/Ajax/Get.php#L2
- https://plugins.trac.wordpress.org/browser/blog2social/tags/9.1.4/includes/Ajax/Get.php#L2
- https://plugins.trac.wordpress.org/browser/blog2social/tags/9.1.4/includes/Ajax/Get.php#L6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b394ee3e-fc1c-40b5-b3c5-a9b5e44a
This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-10-15 via NVD.
vulnfeed aggregates 13758 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.