CVE-2026-92829: Blog2Social WordPress Auth Bypass Flaw

CVE-2026-92829 Overview

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to and including 9.1.0. The plugin fails to verify that a user is authorized to perform specific actions across multiple AJAX endpoints. Authenticated attackers with Contributor-level access or above can view, modify, or delete other users' Blog2Social records. This includes disclosing network authentication IDs, exposing scheduled post content, overwriting Open Graph and Twitter Card metadata on posts they do not own, rebinding another user's social-network authorization, and mass-hiding all scheduled posts sitewide. The b2s_security_nonce is emitted on the post-edit meta box that Contributors can render, making the nonce accessible to any eligible authenticated user. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
Low-privileged WordPress users can hijack social-network connections, tamper with other authors' scheduled posts and share metadata, and disable scheduled posting across the entire site.

Affected Products

Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress
All versions up to and including 9.1.0
Fixed in version 9.1.1

Discovery Timeline

2026-09-25 - CVE-2026-92829 published to the National Vulnerability Database
2026-09-25 - CVE-2026-92829 last updated in NVD

Technical Details for CVE-2026-92829

Vulnerability Analysis

The Blog2Social plugin exposes multiple AJAX handlers that act on per-user records, scheduled posts, and social-network authorization bindings. These handlers accept object identifiers from the request but do not confirm that the submitted identifier belongs to the current user. A Contributor can therefore invoke actions scoped to records owned by Editors, Authors, or Administrators. The attacker can read authentication identifiers tied to third-party social networks, modify Open Graph and Twitter Card metadata on arbitrary posts, rebind another user's social-network authorization, and set a hide flag on all scheduled posts sitewide.

The nonce check present in the handlers does not add security value. The b2s_security_nonce is rendered inside the post-edit meta box, which Contributors are permitted to view. Any user at Contributor role or above can read the nonce from the DOM and replay it against the vulnerable endpoints.

Root Cause

The root cause is missing object-level authorization in the AJAX endpoints under includes/Ajax/Get.php and includes/Ajax/Post.php, together with helpers in includes/B2S/Calendar/Filter.php and includes/B2S/Post/Tools.php. The handlers rely on nonce verification and WordPress capability checks for low-privileged roles, but they do not confirm that the record identifier passed in the request belongs to the calling user.

Attack Vector

An attacker authenticates as a Contributor or higher. The attacker opens a post-edit screen to retrieve the b2s_security_nonce, then issues crafted admin-ajax.php requests supplying arbitrary post or user identifiers. The vulnerable handlers process the request against another user's data because ownership is never validated. See the Blog2Social AJAX Post handler and the patched 9.1.1 handler for the before-and-after implementation.

No verified public exploit code is available at the time of writing. The vulnerability mechanism is documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-92829

Indicators of Compromise

Unexpected admin-ajax.php POST requests carrying action=b2s_* parameters from Contributor-level accounts.
Scheduled posts belonging to other authors appearing hidden, modified, or missing from the Blog2Social calendar.
Open Graph or Twitter Card metadata changes on posts whose author did not initiate the edit.
Social-network authorization records showing new bindings or token reassignments without a corresponding admin action.

Detection Strategies

Audit WordPress access logs for high-frequency admin-ajax.php traffic from low-privileged accounts targeting Blog2Social actions.
Compare wp_b2s_* database tables against post ownership in wp_posts to find mismatched user_id and author relationships.
Alert on any Contributor account issuing requests that reference post or user IDs it does not own.

Monitoring Recommendations

Enable WordPress audit logging for role-based actions and plugin AJAX endpoints.
Forward webserver and PHP error logs to a centralized log platform for correlation across sites.
Monitor Blog2Social settings and scheduled-post tables for unexpected bulk changes, especially sitewide hide operations.

How to Mitigate CVE-2026-92829

Immediate Actions Required

Update the Blog2Social plugin to version 9.1.1 or later on every WordPress site in the environment.
Review all Contributor, Author, and Editor accounts and remove any that are unused or unexpected.
Rotate any social-network credentials and reauthorize network connections managed through Blog2Social.
Review scheduled posts and post metadata for unauthorized modifications before republishing.

Patch Information

The vendor addressed the authorization bypass in Blog2Social version 9.1.1. The patched AJAX handler is available in the Blog2Social 9.1.1 source. WordPress site operators should apply the update through the plugin manager or wp-cli.

Workarounds

Temporarily deactivate the Blog2Social plugin on sites that cannot be updated immediately.
Restrict Contributor-level and higher account creation and require administrator approval for new accounts.
Place a Web Application Firewall rule in front of admin-ajax.php to block Blog2Social actions from low-privileged users until patching completes.

bash

# Update the Blog2Social plugin using wp-cli
wp plugin update blog2social --version=9.1.1

# Verify the installed version
wp plugin get blog2social --field=version

# If immediate patching is not possible, deactivate the plugin
wp plugin deactivate blog2social