Missing Authorization Vulnerability in Blog2Social Plugin by WordPress
CVE-2026-7051

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Blog2social: Social Media Auto Post & Scheduler
Vendor
CVE Published:
13 May 2026

What is CVE-2026-7051?

The Blog2Social plugin for WordPress is affected by a missing authorization vulnerability, allowing authenticated attackers to manipulate post records. Specifically, the functions B2S_Post_Tools::deleteUserPublishPost() and B2S_Post_Tools::deleteUserSchedPost() lack necessary ownership verification. This vulnerability enables attackers to delete any user's B2S post records by sending arbitrary post ID values through the 'postId' parameter. The absence of a blog_user_id constraint in the database query significantly threatens the integrity of social media content, potentially disrupting users' content publishing workflows.

Affected Version(s)

Blog2Social: Social Media Auto Post & Scheduler 0 <= 8.9.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/blog2social/tr...
https://plugins.trac.wordpress.org/browser/blog2social/ta...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nicky Dev
.