PT-2025-45176 · WordPress · Blog2Social: Social Media Auto Post & Scheduler

Liontree · Published 2025-11-06 · Updated 2025-11-06 · CVE-2025-12560

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Blog2Social: Social Media Auto Post & Scheduler versions prior to 8.6.1

Description The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is susceptible to a Server-Side Request Forgery issue in versions up to and including 8.6.0. Authenticated attackers with Subscriber-level access or higher can leverage this to make web requests to arbitrary locations from the web application. This could allow them to query and modify information from internal services via the getFullContent() function. The vulnerable parameter is post url.

Recommendations Update Blog2Social: Social Media Auto Post & Scheduler to version 8.6.1 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-12560

Affected Products

Blog2Social: Social Media Auto Post & Scheduler

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-12560 · Security Note
• https://plugins.trac.wordpress.org/changeset/3389636/blog2social · Note
• https://t.me/CVEtracker/36673 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2ea06520-d7a9-49bb-812e-2fa2e50d0ec2?source=cve · Note
• https://t.me/cveNotify/141896 · Telegram Post