PT-2026-28203 · WordPress · Wordpress+1

Mariusz Maik

·

Published

2026-03-26

·

Updated

2026-03-26

·

CVE-2026-4331

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to and including 8.8.2
Description The Blog2Social plugin for WordPress is susceptible to unauthorized data loss. The resetSocialMetaTags() function inadequately verifies user permissions, only checking for 'read' capability and a valid b2s security nonce. Because the plugin grants the 'blog2social access' capability to all roles upon activation, attackers with Subscriber-level access or higher can access the admin pages where the nonce is available. This allows them to delete all b2s post meta records from the wp postmeta table, resulting in the permanent removal of custom social media meta tags for all posts on the site.
Recommendations Versions prior to 8.8.3 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4331

Affected Products

Blog2Social
Wordpress