Read the docs
TI-2026-60340 Aliases CVE-2026-89031GHSA-f53j-3ghj-6c45

Blog2Social WordPress Plugin < 9.1.0 Broken Access Control via b2s_calendar_move_post

Priority LOW 24CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s_posts table using only the attacker-supplied b2s_id primary key with no blog_user_id ownership constraint, allowing any user with the edit_posts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00298 22nd percentileScored 2026-11-07
Fix Fixed Blog2Social (Adenion): 9.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pr-gatewayBlog2Socialbefore 9.1.09.1.0Patch availableCNA
  • Blog2Social Vendorpr-gateway Affected before 9.1.0 Fixed in 9.1.0 Patch available CNA

Remediation

  • Fix · CNA Blog2Social (Adenion) Fixed in 9.1.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Adenion Blog2Social 9.1.0

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-60339 Blog2Social WordPress Plugin < 9.1.0 User Email Disclosure via b2s_search_userPriority LOW 24
    • TI-2026-60338 Blog2Social WordPress Plugin < 9.1.0 User Enumeration via AJAX HandlerPriority LOW 24
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-89031
  2. 2026-10-03 Alias added: GHSA-f53j-3ghj-6c45

References

Patch 1

  • TI-2022-02999 Blog2Social < 6.9.10 - Subscriber+ SQLi CVSS 3.1HIGH 8.8
  • TI-2022-03000 Blog2Social < 6.9.10 - Subscriber+ SSRF CVSS 3.1MEDIUM 6.5
  • TI-2023-03658 Blog2Social < 7.2.1 - Reflected XSS CVSS 3.1MEDIUM 6.1
  • TI-2025-03671 Blog2Social: Social Media Auto Post & Scheduler < 8.4.0 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
  • TI-2019-10204 The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection. CVSS 3.1CRITICAL 9.8
  • TI-2024-03309 Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injection CVSS 3.1CRITICAL 9.9
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences