PT-2026-40563 · WordPress · Blog2Social

Nicky Dev · Published 2026-05-13 · Updated 2026-05-13 · CVE-2026-7051

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Blog2Social: Social Media Auto Post & Scheduler versions prior to 8.9.1

Description The plugin is affected by missing authorization due to a lack of ownership verification in the deleteUserPublishPost() and deleteUserSchedPost() functions. These functions do not include a blog user id constraint in their database queries, which allows authenticated attackers to soft-delete any user's post records by providing arbitrary sequential wp b2s posts.id values through the postId parameter. This can lead to the deletion of other users' published and scheduled social media posts, disrupting content publishing workflows.

Recommendations Update to a version later than 8.9.0. As a temporary workaround, restrict access to the deleteUserPublishPost() and deleteUserSchedPost() functions to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-7051

Affected Products

Blog2Social

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2026-7051 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3523333%40blog2social&new=3523333%40blog2social&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/blog2social/tags/8.9.0/includes/B2S/Post/Tools.php#L24 · Note
• https://plugins.trac.wordpress.org/browser/blog2social/trunk/includes/Ajax/Post.php#L1947 · Note
• https://plugins.trac.wordpress.org/browser/blog2social/tags/8.8.2/includes/Ajax/Post.php#L1947 · Note
• https://plugins.trac.wordpress.org/browser/blog2social/tags/8.9.0/includes/Ajax/Post.php#L2264 · Note
• https://plugins.trac.wordpress.org/browser/blog2social/tags/8.8.2/includes/B2S/Post/Tools.php#L24 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f0859e21-851a-4a6d-aa6c-9f759c5866d9?source=cve · Note
• https://plugins.trac.wordpress.org/browser/blog2social/tags/8.8.2/includes/Ajax/Post.php#L2264 · Note
• https://plugins.trac.wordpress.org/browser/blog2social/trunk/includes/B2S/Post/Tools.php#L84 · Note
• https://plugins.trac.wordpress.org/browser/blog2social/tags/8.8.2/includes/B2S/Post/Tools.php#L84 · Note
• https://t.me/CVEtracker/53608 · Telegram Post
• https://plugins.trac.wordpress.org/browser/blog2social/tags/8.9.0/includes/Ajax/Post.php#L1947 · Note
• https://plugins.trac.wordpress.org/browser/blog2social/trunk/includes/Ajax/Post.php#L2264 · Note
• https://plugins.trac.wordpress.org/browser/blog2social/trunk/includes/B2S/Post/Tools.php#L24 · Note