PT-2026-1759 · WordPress · Blog2Social: Social Media Auto Post & Scheduler

Youcef Hamdani

·

Published

2026-01-10

·

Updated

2026-01-10

·

CVE-2025-14943

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions prior to 8.7.2
Description The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is susceptible to exposure of sensitive information. This occurs because of an inadequate authorization check within the getShipItemFullText function. The function only confirms a user possesses 'read' capability and a valid nonce, without verifying permission to access the specific post. This allows authenticated attackers with Subscriber-level access or higher to retrieve data from password-protected, private, or draft posts.
Recommendations Update Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress to version 8.7.2 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-14943

Affected Products

Blog2Social: Social Media Auto Post & Scheduler