CVE-2026-4331: Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags() function only verifying that the user has the 'read' capability and a valid b2ssecuritynonce, both of which are available to Subscriber-level users, as the plugin grants 'blog2socialaccess' capability to all roles upon activation, allowing them to access the plugin's admin pages where the nonce is output. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all b2spostmeta records from the wppostmeta table, permanently removing all custom social media meta tags for every post on the site.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4331?
CVE-2026-4331 is classified as a high severity vulnerability due to the potential for unauthorized data loss.
How do I fix CVE-2026-4331?
To fix CVE-2026-4331, update the Blog2Social: Social Media Auto Post & Scheduler plugin to version 8.8.3 or later.
What type of vulnerability is CVE-2026-4331?
CVE-2026-4331 is an authorization vulnerability that allows authenticated users to delete arbitrary post meta.
Who is affected by CVE-2026-4331?
Users of Blog2Social: Social Media Auto Post & Scheduler plugin versions 8.8.2 and earlier are affected by CVE-2026-4331.
What actions can be exploited in CVE-2026-4331?
The b2s_reset_social_meta_tags AJAX action can be exploited to perform unauthorized deletion of post metadata.