Insecure Direct Object Reference in Blog2Social Plugin for WordPress

CVE-2026-108092

What is CVE-2026-108092?

The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress has a significant security flaw that allows authenticated users with Contributor-level access or higher to exploit Insecure Direct Object Reference. This vulnerability exists in all versions up to and including 9.1.4, affecting AJAX handlers b2s_ship_item and b2s_ship_item_reload_url, which fail to enforce proper authorization. As a result, attackers can gain unauthorized access to view the titles and contents of posts, including private and pending content that belongs to other users. This exposure raises serious concerns about user privacy and data protection within WordPress sites utilizing this plugin.

References