CVE-2026-89029

Name of the Vulnerable Software and Affected Versions Blog2Social plugin for WordPress versions prior to 9.1.0

Description Low-privileged users can enumerate WordPress user accounts. The b2s get select mandant user AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs provided in the owner parameter to display names without verifying if the caller is authorized to access user account data. This allows any user with the edit posts capability to map WordPress user IDs to display names and confirm the existence of accounts for arbitrary IDs.

Recommendations Update the Blog2Social plugin for WordPress to version 9.1.0 or later.