CVE-2026-89029: Blog2Social WordPress User Enumeration Flaw

CVE-2026-89029 Overview

CVE-2026-89029 is a user enumeration vulnerability in the Adenion Blog2Social plugin for WordPress before version 9.1.0. The flaw resides in the b2s_get_select_mandant_user AJAX handler within includes/Ajax/Get.php. The handler resolves arbitrary user IDs supplied in the owner parameter to WordPress display names without verifying that the caller is authorized to read user account data. Any authenticated user with the edit_posts capability can map WordPress user IDs to display names and confirm the existence of arbitrary accounts. The weakness is classified as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Low-privileged authenticated users can enumerate all WordPress accounts on affected sites, exposing administrator usernames for use in credential-stuffing and brute-force campaigns.

Affected Products

Adenion Blog2Social plugin for WordPress prior to version 9.1.0
WordPress installations that grant contributor, author, or editor roles to untrusted users
Multi-author WordPress sites where the edit_posts capability is broadly assigned

Discovery Timeline

2026-09-16 - CVE-2026-89029 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89029

Vulnerability Analysis

The Blog2Social plugin exposes an AJAX endpoint that accepts an owner parameter representing a WordPress user ID. The b2s_get_select_mandant_user handler in includes/Ajax/Get.php looks up the supplied ID and returns the associated display name in its response. The handler enforces only the built-in edit_posts capability check, which is granted to contributors, authors, editors, and administrators. It does not validate that the caller has authority to view account metadata for other users, nor does it restrict the lookup to accounts the caller legitimately manages.

An attacker holding any account with edit_posts can iterate through sequential user IDs starting at 1, which typically corresponds to the initial administrator account. Each successful response confirms the account exists and reveals the display name, which frequently matches or hints at the login username.

Root Cause

The root cause is a missing authorization check on a user-controlled identifier, mapped to [CWE-639]. The handler treats the owner parameter as trusted context and performs the user lookup without evaluating ownership, role hierarchy, or object-level access controls.

Attack Vector

Exploitation requires network access to the WordPress admin-ajax.php endpoint and a valid session with the edit_posts capability. The attacker submits repeated AJAX POST requests, varying the owner value across the user ID range. The server returns display names for valid IDs and an empty or error response for missing IDs, enabling reliable enumeration.

No verified exploit code has been published. Refer to the VulnCheck Advisory on User Enumeration for the vendor-reviewed technical description.

Detection Methods for CVE-2026-89029

Indicators of Compromise

Repeated POST requests to /wp-admin/admin-ajax.php with the action=b2s_get_select_mandant_user parameter from a single authenticated session.
Sequential or high-volume variation of the owner parameter values within a short time window.
Enumeration-pattern traffic originating from low-privileged accounts such as contributors or authors.

Detection Strategies

Alert on any authenticated user issuing more than a small number of b2s_get_select_mandant_user AJAX calls in a defined interval.
Correlate AJAX enumeration traffic with subsequent failed login attempts against enumerated usernames.
Baseline normal Blog2Social AJAX usage per account and flag deviations, particularly from non-editor roles.

Monitoring Recommendations

Ingest WordPress access logs and PHP application logs into a centralized analytics platform for query and correlation.
Monitor authentication logs for spikes in failed logins that reference display names recently returned by the vulnerable handler.
Track outbound requests to admin-ajax.php per authenticated session and set thresholds tuned to legitimate plugin usage.

How to Mitigate CVE-2026-89029

Immediate Actions Required

Upgrade the Adenion Blog2Social plugin to version 9.1.0 or later on all WordPress installations.
Audit existing user accounts and revoke edit_posts privileges from users that do not require content authoring.
Reset passwords for administrator accounts whose display names may already have been enumerated.

Patch Information

Adenion resolved the vulnerability in Blog2Social 9.1.0. Site operators should update through the WordPress plugin manager or by installing the latest release referenced on the WordPress Plugin Documentation page.

Workarounds

Deactivate the Blog2Social plugin until the site can be upgraded to 9.1.0.
Use a web application firewall rule to block requests to admin-ajax.php where action=b2s_get_select_mandant_user originates from non-administrator sessions.
Enforce multi-factor authentication for all WordPress accounts to reduce the value of enumerated usernames in credential-stuffing attacks.

bash

# Configuration example: WAF rule blocking the vulnerable AJAX action
# ModSecurity example
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,id:1026089029,phase:2,deny,status:403,\
     msg:'Block Blog2Social user enumeration (CVE-2026-89029)'"
    SecRule ARGS:action "@streq b2s_get_select_mandant_user"