User Enumeration Vulnerability in Adenion Blog2Social Plugin for WordPress

CVE-2026-89029

What is CVE-2026-89029?

The Adenion Blog2Social plugin for WordPress prior to version 9.1.0 contains a vulnerability that permits low-privileged users to enumerate WordPress user accounts. This flaw arises from the b2s_get_select_mandant_user AJAX handler, which resolves arbitrary user IDs specified in the owner parameter to display names without ensuring that the requester has the appropriate authorization. As a result, any user with the edit_posts capability can map WordPress user IDs to their corresponding display names, effectively confirming the existence of accounts associated with those IDs, potentially compromising the security of user data.

References