Description

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to view, modify, or delete other users' Blog2Social records, including disclosing another user's network authentication IDs and scheduled post content, overwriting Open Graph and Twitter Card post metadata on posts they do not own, rebinding another user's social-network authorization, and mass-hiding all users' scheduled posts sitewide. The plugin's b2s_security_nonce is emitted on the post-edit meta box, which Contributors can render, making the nonce available to any authenticated user at that role level or above.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-25T07:16:55.750Z",
  "pubdate": "2026-09-25T07:16:55.750Z",
  "executiveSummary": "The Blog2Social plugin for WordPress, in versions up to and including 9.1.0, contains an authorization bypass vulnerability.\nThe vulnerability stems from improper access control validation within the plugin's administrative functions, allowing users with 'Contributor' privileges or higher to perform unauthorized actions on behalf of other users.\nThis security flaw enables authenticated attackers to access, modify, or delete sensitive social media scheduling records and network authentication configurations belonging to other users.\nThe attack is facilitated by the insecure exposure of the 'b2s_security_nonce', which is accessible to lower-privileged users via the post-edit meta box.\nThe impact includes the disclosure of social network authentication IDs, unauthorized manipulation of Open Graph and Twitter Card metadata, and the ability to conduct mass-disruption of sitewide scheduled social media posts.\nExploitation requires the attacker to possess at least 'Contributor' level authentication within the WordPress environment.\nThis vulnerability presents a significant risk to data integrity and social media account security for organizations utilizing the Blog2Social plugin.",
  "technicalDetails": "The vulnerability originates from a failure in the plugin to enforce server-side capability checks for requests initiated via the plugin's administrative interface.\nThe primary mechanism of exploitation relies on the predictable and insecure distribution of the 'b2s_security_nonce'. Because this nonce is rendered directly within the post-edit meta box—a component accessible to Contributors—the plugin fails to restrict the token to authorized administrators or post owners.\nAn attacker can extract this nonce and include it in crafted HTTP requests to the plugin's API endpoints, which perform actions without validating that the authenticated user is the legitimate owner of the target data or has appropriate administrative permissions.\nThe attack flow proceeds as follows: First, the attacker navigates to the post-edit screen where the 'b2s_security_nonce' is emitted in the HTML source or script parameters. Second, the attacker harvests this nonce. Third, using the nonce to bypass non-repudiation and security checks, the attacker sends unauthorized requests to internal plugin functions. These functions, lacking additional capability verification (e.g., using current_user_can()), process the requests as if they originated from an authorized administrative user.\nThis allows the attacker to reach several sensitive functionalities: 1) Disclosure: Reading another user's social network authentication IDs and scheduled post content. 2) Modification/Destruction: Overwriting Open Graph and Twitter Card metadata on posts owned by others, effectively performing unauthorized SEO or social engineering changes. 3) Rebinding: Redirecting social-network authorizations to attacker-controlled accounts or breaking existing links. 4) Mass Disruption: Executing commands to hide or purge scheduled posts across the entire site installation.\nThe vulnerable component involves the plugin’s request handling logic where the 'b2s_security_nonce' is treated as sufficient evidence of authorization without performing an explicit check against the current user's session role or ownership of the specific record being modified.\nBecause the plugin does not differentiate between a Contributor attempting to edit their own post and a Contributor attempting to manipulate global plugin settings or other users' social media connections, the privilege boundary is effectively collapsed.\nThe scope of the impact is constrained to the context of the WordPress installation; however, the downstream effect on social media accounts integrated via the plugin represents a critical failure in the plugin's security architecture."
}