CVE-2026-89031: Blog2Social WordPress Plugin < 9.1.0 Broken Access Control via b2s_calendar_move_post
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2scalendarmovepost AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2sposts table using only the attacker-supplied b2sid primary key with no bloguserid ownership constraint, allowing any user with the editposts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Blog2Social pluginto a version that resolves this vulnerability.Fixed in 9.1.0 - Compensating control
Restrict the WordPress capability edit_posts to only trusted users, since the described broken access control allows any user with edit_posts to modify other users' scheduled social media post records.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated WordPress user who has the edit_posts capability can exploit it. The issue affects scheduled social media post records belonging to other users.
What access does an attacker need?
The attacker needs a WordPress account with the edit_posts capability and the ability to invoke the b2s_calendar_move_post AJAX handler. No user interaction is required.
What can an attacker change?
An attacker can use another user's b2s_id record identifier to modify that user's scheduled social media post record. This can reschedule a post, suppress it, or alter its publication state.
How can administrators determine whether their installation is affected?
Installations running Blog2Social versions before 9.1.0 are affected. The vulnerable handler is b2s_calendar_move_post in includes/Ajax/Post.php and updates b2s_posts records without a blog_user_id ownership constraint.