CVE-2026-108092

Name of the Vulnerable Software and Affected Versions Blog2Social – Social Media Auto Post & Scheduler versions prior to 9.1.5

Description An Insecure Direct Object Reference exists due to the b2s ship item and b2s ship item reload url AJAX handlers lacking per-object authorization on the postId parameter. This allows authenticated attackers with Contributor-level access or higher to read the title and content of any post, including private and pending posts belonging to other users.

Recommendations Update Blog2Social – Social Media Auto Post & Scheduler to version 9.1.5 or later.