Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-89031Blog2Social WordPress Plugin < 9.1.0 Broken Access Control via b2s_calendar_move_post

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in Blog2Social from Adenion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 77.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s_posts table using only the attacker-supplied b2s_id primary key with no blog_user_id ownership constraint, allowing any user with the edit_posts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post.

Affected products (as reported)

Vendor	Product	Versions
Adenion	Blog2Social	0 – before 9.1.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

WordPress Changelog release-notes, patch
https://www.vulncheck.com/advisories/blog2social-wordpress-plugin-broken-access-control-via-b2s-calendar-move-post third-party-advisory