CVE-2026-108092
Deferred Deferred - Pending Action

Insecure Direct Object Reference in Blog2Social WordPress Plugin

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Wordfence

Description
The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers lacking per-object authorization on the postId parameter. This makes it possible for authenticated attackers with Contributor-level access and above to read the title and content of any post, including private and pending posts belonging to other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-108092
EUVD
EUVD-2026-101926

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pr-gateway Blog2Social: Social Media Auto Post & Scheduler 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Blog2Social WordPress plugin. It affects versions up to 9.1.4 and allows authenticated attackers with Contributor-level access or higher to read private or pending posts by manipulating the postId parameter in AJAX handlers.

Detection Guidance

To detect this vulnerability, check WordPress sites using the Blog2Social plugin versions up to 9.1.4. Look for unauthorized access to post content via the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers. Review server logs for suspicious AJAX requests targeting these endpoints with varying postId parameters.

Impact Analysis

If you use this plugin, attackers could access sensitive content like private drafts or unpublished posts. This could lead to data leaks, unauthorized exposure of confidential information, or reputational damage if sensitive content is exposed.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data in private posts. For HIPAA, if health-related content is leaked, it may breach confidentiality requirements. Organizations must ensure such vulnerabilities are patched to maintain compliance.

Mitigation Strategies

Update the Blog2Social plugin to the latest version beyond 9.1.4 to address the insecure direct object reference vulnerability. Ensure only trusted users have Contributor-level access or higher.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108092. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart