CVE-2026-89030 Overview
CVE-2026-89030 is an authorization flaw in the Adenion Blog2Social plugin for WordPress before version 9.1.0. The plugin exposes the email addresses of every registered WordPress user to low-privileged accounts. Any authenticated user holding the edit_posts capability can query the b2s_search_user AJAX endpoint and retrieve email addresses belonging to administrators and other users. The plugin fails to enforce the list_users capability check before returning user data. This weakness is categorized as [CWE-862] Missing Authorization.
Critical Impact
Authenticated attackers with contributor or author-level access can enumerate administrator email addresses, enabling targeted phishing, credential-stuffing, and account takeover campaigns against WordPress site operators.
Affected Products
- Adenion Blog2Social plugin for WordPress, all versions before 9.1.0
- WordPress sites where the plugin is installed and activated
- Any WordPress account with the edit_posts capability (Contributor, Author, Editor)
Discovery Timeline
- 2026-09-16 - CVE-2026-89030 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89030
Vulnerability Analysis
The flaw resides in the b2s_search_user AJAX handler defined in includes/Ajax/Get.php. The handler invokes B2S_Tools::searchUser() in includes/Tools.php to look up WordPress users matching a search term. The function returns full user records, including email addresses, in its JSON response.
The handler validates that the caller is authenticated and possesses edit_posts. It does not verify that the caller holds list_users, which is the WordPress capability normally required to enumerate user account details. Contributor and author roles inherit edit_posts by default, so any user above the subscriber tier can invoke the endpoint.
Email addresses returned by the endpoint include those of administrators. Attackers can chain this disclosure with phishing, password spraying, or WordPress login enumeration to pivot toward site takeover.
Root Cause
The root cause is a missing capability check [CWE-862]. The b2s_search_user handler in includes/Ajax/Get.php never calls current_user_can('list_users') before returning email data from B2S_Tools::searchUser(). The developer conflated posting privileges with user-enumeration privileges.
Attack Vector
Exploitation requires network access to the WordPress admin-ajax endpoint and a valid low-privileged session. An attacker who registers or compromises a Contributor account issues a POST request to wp-admin/admin-ajax.php with action=b2s_search_user and a search term. The response contains matching users' email addresses. No user interaction from an administrator is required. See the VulnCheck advisory for Blog2Social for the reported request pattern.
Detection Methods for CVE-2026-89030
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php containing action=b2s_search_user from accounts that do not hold list_users.
- Unexpected b2s_search_user calls originating from Contributor or Author sessions in web-server access logs.
- Repeated single-character or wildcard search terms sent to the endpoint, indicating enumeration.
Detection Strategies
- Review WordPress access logs for the b2s_search_user action string and correlate with the requesting user role.
- Enable WordPress audit logging plugins to record AJAX actions per user and alert on non-admin invocations of b2s_* endpoints.
- Deploy WAF rules that match the action=b2s_search_user parameter and evaluate the session's role cookie before allowing the request.
Monitoring Recommendations
- Alert on any Contributor or Author account issuing more than a handful of admin-ajax.php requests per minute.
- Track outbound email sent to administrator addresses that were previously not public, which may indicate follow-on phishing.
- Baseline the volume of b2s_search_user traffic and flag deviations after user-registration spikes.
How to Mitigate CVE-2026-89030
Immediate Actions Required
- Upgrade the Blog2Social plugin to version 9.1.0 or later on every WordPress site where it is installed.
- Audit existing Contributor, Author, and Editor accounts and remove any that are not required.
- Force password rotation for administrator accounts whose email addresses may have been disclosed.
- Enable multi-factor authentication for all WordPress roles above Subscriber to blunt phishing that leverages leaked addresses.
Patch Information
Adenion released a fixed build in Blog2Social version 9.1.0. The patch adds an authorization check to the b2s_search_user handler so that only callers with the list_users capability receive user email data. Refer to the Blog2Social plugin page on WordPress.org for release notes and download links.
Workarounds
- Deactivate the Blog2Social plugin until the site can be upgraded to 9.1.0.
- Restrict access to wp-admin/admin-ajax.php at the WAF or reverse-proxy layer for the b2s_search_user action when the session cookie is not tied to an administrator.
- Disable open user registration and remove non-essential low-privileged accounts to reduce the pool of potential attackers.
# Example WP-CLI commands to check the installed version and update the plugin
wp plugin get blog2social --field=version
wp plugin update blog2social --version=9.1.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.