{"id":"CVE-2026-89031","title":"Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users","summary":"Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s_pos…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cwe":["CWE-639"],"vendor":"Adenion","product":"Blog2Social","affected":["Blog2Social < 9.1.0"],"published":"2026-09-16","updated":"2026-09-21","sourceUpdated":"2026-09-21T18:17:11.810","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89031","references":[{"url":"https://wordpress.org/plugins/blog2social/#developers","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/blog2social-wordpress-plugin-broken-access-control-via-b2s-calendar-move-post","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-21T17:44:57.417956Z"},"epss":0.00232,"epssPercentile":0.143,"ingestedAt":"2026-09-16T14:57:28.066Z","slug":"CVE-2026-89031","body":"## Overview\n\nAdenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s_posts table using only the attacker-supplied b2s_id primary key with no blog_user_id ownership constraint, allowing any user with the edit_posts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}