---
id: CVE-2026-89031
title: >-
  Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged
  users to modify the scheduled post records of other users
summary: >-
  Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged
  users to modify the scheduled post records of other users. The
  b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php issues an UPDATE
  against the b2s_pos…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-639
vendor: Adenion
product: Blog2Social
affected:
  - Blog2Social < 9.1.0
published: '2026-09-16'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T18:17:11.810'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89031'
references:
  - url: 'https://wordpress.org/plugins/blog2social/#developers'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/blog2social-wordpress-plugin-broken-access-control-via-b2s-calendar-move-post
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T17:44:57.417956Z'
epss: 0.00232
epssPercentile: 0.14323
ingestedAt: '2026-09-16T14:57:28.066Z'
---

## Overview

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s_posts table using only the attacker-supplied b2s_id primary key with no blog_user_id ownership constraint, allowing any user with the edit_posts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.