CVE-2026-89029: Blog2Social WordPress Plugin < 9.1.0 User Enumeration via AJAX Handler
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2sgetselectmandantuser AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller is authorized to read user account data, allowing any user with the editposts capability to map WordPress user IDs to display names and confirm account existence for arbitrary IDs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Blog2Social (Adenion Blog2Social plugin)to a version that resolves this vulnerability.Fixed in 9.1.0 - Configuration
Upgrade the Blog2Social plugin to 9.1.0 to address the b2s_get_select_mandant_user AJAX handler issue where the includes/Ajax/Get.php owner parameter resolves user IDs without verifying the caller is authorized to read user account data.
Blog2Social WordPress Plugin Authorization checks for b2s_get_select_mandant_user AJAX handler (includes/Ajax/Get.php owner parameter) = require capability/authorization before resolving arbitrary user IDs to display names
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with the edit_posts capability can exploit it. This is a low-privileged role in many WordPress deployments, but exposure depends on which roles have been granted that capability.
What information can an attacker obtain?
The attacker can submit arbitrary WordPress user IDs through the owner parameter and receive corresponding display names. This lets them confirm whether account IDs exist and map IDs to display names.
Which versions are affected?
Blog2Social versions before 9.1.0 are affected. Updating to version 9.1.0 or later addresses the stated vulnerable version range.
How can I determine whether exploitation may have occurred?
Review requests to the b2s_get_select_mandant_user AJAX handler for owner parameters containing unusual, sequential, or numerous user IDs. The provided information does not identify specific logging fields or indicators beyond use of this handler and parameter.