CVE-2026-108092: Blog2Social WordPress Plugin IDOR Vulnerability

CVE-2026-108092 Overview

CVE-2026-108092 affects the Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress through version 9.1.4. The plugin exposes an Insecure Direct Object Reference (IDOR) [CWE-639] in two AJAX handlers: b2s_ship_item and b2s_ship_item_reload_url. Both handlers accept a postId parameter without validating that the requesting user owns or has rights to the referenced post. Authenticated users with Contributor-level access or higher can retrieve the title and content of any post, including private and pending drafts belonging to other users.

Critical Impact
Authenticated contributors can read private and pending posts authored by editors, administrators, or other contributors, exposing unpublished content and sensitive editorial material.

Affected Products

Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress
All versions up to and including 9.1.4
WordPress sites allowing Contributor-level user registration or multi-author workflows

Discovery Timeline

2026-10-15 - CVE-2026-108092 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-108092

Vulnerability Analysis

The flaw is an Insecure Direct Object Reference in the plugin's AJAX layer. The b2s_ship_item and b2s_ship_item_reload_url endpoints accept a client-supplied postId and return post metadata, including post_title and post_content. The handlers verify that the caller is authenticated with at least Contributor privileges but omit a per-object authorization check against the target post's author or status. As a result, any eligible user can enumerate postId values and retrieve data for posts they would not otherwise see in the WordPress UI, including posts in private or pending status owned by other users.

Root Cause

The root cause is missing authorization logic in the AJAX handlers located in includes/Ajax/Get.php. WordPress capability checks such as read_private_posts or edit_post($postId) are not applied before returning content. The handlers trust the postId parameter and fetch post data directly from the database.

Attack Vector

An attacker needs an authenticated session with Contributor privileges or higher. The attacker sends crafted POST requests to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) invoking either b2s_ship_item or b2s_ship_item_reload_url with an arbitrary numeric postId. The response discloses the title and content of the referenced post regardless of ownership or publication status. No user interaction from the victim is required.

See the WordPress Plugin Code Snippet (line 253), line 275, and line 622 for the affected handlers.

Detection Methods for CVE-2026-108092

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=b2s_ship_item or action=b2s_ship_item_reload_url originating from Contributor-level accounts.
Sequential or enumerated postId values in AJAX request bodies from the same session, suggesting ID brute-forcing.
AJAX responses containing post titles or content for posts the requesting user does not own in the WordPress dashboard.

Detection Strategies

Review WordPress access logs for repeated calls to the two affected AJAX actions from non-privileged user sessions.
Correlate wp_users metadata with AJAX request patterns to identify Contributors accessing content outside their authored posts.
Deploy a WordPress audit logging plugin to record AJAX actions and the postId parameters supplied with each request.

Monitoring Recommendations

Alert on high-volume AJAX requests from a single authenticated session targeting the b2s_ship_item* actions.
Monitor for creation of new Contributor accounts followed shortly by Blog2Social AJAX activity.
Baseline normal plugin usage per user role and flag deviations such as Contributors invoking endpoints associated with scheduled publishing.

How to Mitigate CVE-2026-108092

Immediate Actions Required

Update the Blog2Social plugin to a version later than 9.1.4 once the vendor releases a patched build.
Audit active WordPress users and remove or demote unused Contributor and Author accounts.
Disable open user registration or restrict new registrations to the Subscriber role until patching is complete.

Patch Information

No fixed version is listed in the enriched CVE data at publication. Monitor the Wordfence Vulnerability Report and the official plugin repository for the patched release and apply it as soon as it is available.

Workarounds

Temporarily deactivate the Blog2Social plugin on multi-author sites where private or pending content confidentiality is required.
Use a Web Application Firewall rule to block AJAX requests with action=b2s_ship_item or action=b2s_ship_item_reload_url from users below Editor level.
Restrict access to /wp-admin/admin-ajax.php for the two affected actions at the reverse-proxy or WAF layer until the plugin is updated.

bash

# Example nginx snippet to block the affected AJAX actions
location = /wp-admin/admin-ajax.php {
    if ($request_body ~* "action=(b2s_ship_item|b2s_ship_item_reload_url)") {
        return 403;
    }
}