CVE-2026-89029

The Blog2Social plugin for WordPress before version 9.1.0 exposes the email addresses of all registered users to low-privileged accounts. The b2s_search_user AJAX handler in includes/Ajax/Get.php calls B2S_Tools::searchUser() in includes/Tools.php, which returns the email address of every matching user without restricting access to callers holding the list_users capability, allowing any user with the edit_posts capability to retrieve user email addresses including those of administrators.

The vulnerability allows an unauthenticated attacker to perform XSS attacks in Blog2Social version 8.9.2 and earlier. The attack can be carried out without authentication, increasing the risk of exploitation.

Missing authorization in the Blog2Social plugin for WordPress (up to version 8.8.3). Authenticated attackers with Subscriber access can modify, reschedule, or delete other users' scheduled social media posts by manipulating the b2s_id parameter.

The Blog2Social plugin for WordPress up to version 8.7.0 lacks a capability check in the 'deleteUserCcDraftPost' function. An authenticated attacker with Subscriber-level access or higher can move arbitrary posts to trash.

The Blog2Social plugin for WordPress is vulnerable to Server-Side Request Forgery up to version 8.6.0 via the getFullContent() function. Authenticated attackers with Subscriber-level access can make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services.

The Blog2Social plugin for WordPress is vulnerable to limited file upload due to an incorrect capability check on the uploadVideo() function in versions up to and including 8.6.0. Authenticated attackers with Subscriber-level access and above can upload mp4 files to the 'wp-content/uploads/<YYYY>/<MM>/' directory.