PT-2025-45175 · WordPress · Blog2Social: Social Media Auto Post & Scheduler

Thinnawarth Mathuros · Published 2025-11-06 · Updated 2025-11-06 · CVE-2025-12563

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to and including 8.6.0

Description The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress has a flaw related to file uploads. An incorrect capability check within the uploadVideo() function allows authenticated attackers with Subscriber-level access or higher to upload mp4 files to the 'wp-content/uploads///' directory.

Recommendations Update Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress to a version later than 8.6.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12563

Affected Products

Blog2Social: Social Media Auto Post & Scheduler

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-12563 · Security Note
• https://plugins.trac.wordpress.org/changeset/3389636/blog2social · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3710f139-0f17-426c-b48c-4c42ae4bab5f?source=cve · Note
• https://t.me/CVEtracker/36671 · Telegram Post