CVE-2026-7051: Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 8.9.0. This is due to a missing ownership verification in the B2SPostTools::deleteUserPublishPost() and B2SPostTools::deleteUserSchedPost() functions, neither function includes a bloguserid constraint in its database query, allowing authenticated attackers to soft-delete any user's B2S post records by supplying arbitrary sequential wpb2sposts.id values via the 'postId' parameter. This makes it possible for authenticated attackers to delete other users' published and scheduled social media post records, disrupting content publishing workflows.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Blog2Social: Social Media Auto Post & Scheduler (WordPress plugin)to a version that resolves this vulnerability.Fixed in 8.9.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7051?
CVE-2026-7051 has a medium severity rating due to its potential for unauthorized deletion of posts by authenticated users.
How do I fix CVE-2026-7051?
To fix CVE-2026-7051, update the Blog2Social plugin to version 8.9.1 or later, which resolves the authorization issue.
Who is affected by CVE-2026-7051?
CVE-2026-7051 affects all users of the Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to 8.9.0.
What type of vulnerability is CVE-2026-7051?
CVE-2026-7051 is a missing authorization vulnerability that allows unauthorized deletion of arbitrary post records.
Can CVE-2026-7051 be exploited remotely?
Yes, CVE-2026-7051 can be exploited remotely by authenticated users with subscriber-level access.