CVE-2026-89030

Name of the Vulnerable Software and Affected Versions Blog2Social plugin for WordPress versions prior to 9.1.0

Description Low-privileged accounts can access the email addresses of all registered WordPress users. The issue occurs because the b2s search user AJAX handler in includes/Ajax/Get.php calls the searchUser() function in includes/Tools.php without verifying if the requester has the list users capability. Consequently, any user with the edit posts capability can retrieve email addresses, including those of administrators.

Recommendations Update Blog2Social plugin for WordPress to version 9.1.0 or later.