CVE-2026-89030: Blog2Social WordPress Plugin < 9.1.0 User Email Disclosure via b2s_search_user
Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2ssearchuser AJAX handler in includes/Ajax/Get.php invokes B2STools::searchUser() in includes/Tools.php, which returns the email address of every matching user without restricting access to callers holding the listusers capability, allowing any user with the editposts capability to retrieve user email addresses including those of administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Blog2Social (Adenion) pluginto a version that resolves this vulnerability.Fixed in 9.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user account with the edit_posts capability can query the affected AJAX handler. This includes low-privileged users that can create or edit posts, and the exposed results can include administrator email addresses.
What information can an attacker obtain?
The affected user-search functionality returns email addresses for matching registered WordPress users. The disclosure is limited to email addresses; the provided data does not indicate integrity or availability impact.
Is authentication required?
Yes. Exploitation requires a WordPress account with the edit_posts capability, reflected by the PR:L vector. No user interaction is required, and the handler is reachable over the network.
What should be done to remediate the issue?
Upgrade Blog2Social to version 9.1.0 or later. The affected versions are those before 9.1.0.