CVE-2026-92829

Name of the Vulnerable Software and Affected Versions Blog2Social: Social Media Auto Post & Scheduler versions prior to 9.1.1

Description An authorization bypass exists because the software fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can exploit this to view, modify, or delete records belonging to other users. This includes the disclosure of network authentication IDs and scheduled post content, overwriting Open Graph and Twitter Card post metadata on posts they do not own, rebinding social-network authorizations of other users, and mass-hiding all scheduled posts across the site. The issue is facilitated by the b2s security nonce being emitted on the post-edit meta box, which is accessible to users with the contributor role.

Recommendations Update to a version newer than 9.1.0.