Adenion Blog2Social Plugin up to 9.0.x AJAX includes/Ajax/Post.php b2s_calendar_move_post b2s_id privileges management

Summaryinfo

A vulnerability was found in Adenion Blog2Social Plugin up to 9.0.x. It has been classified as problematic. Impacted is the function b2s_calendar_move_post of the file includes/Ajax/Post.php of the component AJAX Handler. This manipulation of the argument b2s_id causes privileges management. The identification of this vulnerability is CVE-2026-89031. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Adenion Blog2Social Plugin up to 9.0.x and classified as problematic. Affected by this vulnerability is the function b2s_calendar_move_post of the file includes/Ajax/Post.php of the component AJAX Handler. The manipulation of the argument b2s_id with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect integrity, and availability. The summary by CVE is:

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s_posts table using only the attacker-supplied b2s_id primary key with no blog_user_id ownership constraint, allowing any user with the edit_posts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post.

The advisory is shared at wordpress.org. This vulnerability is known as CVE-2026-89031 since 09/10/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

By approaching the search of inurl:includes/Ajax/Post.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 9.1.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Blog Software

Vendor

• Adenion

Name

• Blog2Social Plugin

Version

• 9.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion