CVE-2026-89030 in Blog2Social Plugin
Summary
by MITRE • 09/16/2026
Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2s_search_user AJAX handler in includes/Ajax/Get.php invokes B2S_Tools::searchUser() in includes/Tools.php, which returns the email address of every matching user without restricting access to callers holding the list_users capability, allowing any user with the edit_posts capability to retrieve user email addresses including those of administrators.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified involves a critical information disclosure flaw within the Adenion Blog2Social plugin for WordPress prior to version 9.1.0. This security issue stems from an improper implementation of access controls on server-side AJAX endpoints, specifically affecting the b2s_search_user handler located in includes/Ajax/Get.php. The core technical failure occurs when this endpoint invokes the searchUser method within the B2S_Tools class found in includes/Tools.php. Instead of enforcing strict capability checks that align with WordPress security standards for sensitive user data retrieval, the function returns comprehensive profile information, including email addresses, for all matching users without verifying if the requesting account possesses the necessary permissions to view such private details.
From a technical perspective, this represents a classic case of broken access control where the application logic fails to validate the privilege level of the caller against the sensitivity of the requested resource. In WordPress environments, retrieving user email addresses is typically restricted to users with the list_users capability or higher administrative privileges due to privacy regulations and security best practices. However, in this specific implementation, any authenticated user holding even the minimal edit_posts capability can trigger this AJAX handler and receive a JSON response containing the email addresses of all registered users on the site. This includes high-privilege accounts such as administrators, thereby exposing sensitive personally identifiable information to low-level contributors or subscribers who should have no visibility into other users' contact details.
The operational impact of this vulnerability is significant for both website owners and end-users. The exposure of email addresses facilitates targeted phishing campaigns, credential stuffing attacks, and social engineering efforts against site administrators and regular users alike. Attackers can aggregate these emails to build mailing lists for spam or use them in conjunction with other leaked data sources to enhance the effectiveness of their malicious activities. Furthermore, this breach undermines user trust and may violate privacy compliance frameworks such as GDPR if personal data is exposed without consent or adequate security measures. The ease of exploitation means that even attackers with minimal initial access can escalate their intelligence gathering capabilities significantly.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, specifically the failure to enforce proper authorization checks on sensitive functions. Additionally, it maps to MITRE ATT&CK technique T1078, Valid Accounts, as attackers leverage legitimate but low-privileged credentials to access unauthorized data resources within the system environment. The exploitation path typically involves sending a crafted AJAX request with valid session cookies from an authenticated user account possessing edit_posts rights, resulting in the exfiltration of bulk user email addresses via HTTP response payloads.
To mitigate this risk, site administrators must immediately update the Adenion Blog2Social plugin to version 9.1.0 or later where these access control checks have been properly implemented. Until an official patch is applied, temporary mitigations include restricting AJAX endpoint accessibility through web application firewall rules that block unauthorized calls to b2s_search_user from non-administrative sources. Additionally, reviewing and tightening user role capabilities on the WordPress installation can reduce the attack surface by ensuring fewer accounts possess edit_posts privileges if they do not require them for their specific operational functions. Regular security audits of custom plugins are recommended to ensure adherence to established coding standards that prevent similar information disclosure flaws in future releases.