Is CVE-2026-89029 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89029 being exploited in the wild.

How severe is CVE-2026-89029?

Medium severity, with a CVSS score of 4.3, published 16 September 2026.

Which products and versions are affected?

Adenion Blog2Social before 9.1.0.

Is there a fix for CVE-2026-89029?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-89029 attacked?

It is attacked over the network.

Am I affected by CVE-2026-89029?

Check whether you run Adenion Blog2Social at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89029: Adenion Blog2Social WordPress plugin user enumeration via AJAX handler

CVE-2026-89029 · Severity: medium · CVSS 4.3 · Published 2026-09-16

Blog2Social is a WordPress plugin that automates posting content to social media platforms. The plugin fails to properly verify user permissions in an AJAX handler, allowing any user with basic posting rights to discover the names and IDs of all WordPress user accounts on the site. An attacker with a low-privilege account could systematically enumerate all site users and confirm their existence, which could facilitate further targeted attacks.

Technologies: Adenion Blog2Social. Vendors: Adenion.

Quick answers

Is CVE-2026-89029 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89029 being exploited in the wild.
How severe is CVE-2026-89029?: Medium severity, with a CVSS score of 4.3, published 16 September 2026.
Which products and versions are affected?: Adenion Blog2Social before 9.1.0.
Is there a fix for CVE-2026-89029?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-89029 attacked?: It is attacked over the network.
Am I affected by CVE-2026-89029?: Check whether you run Adenion Blog2Social at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-639) in the b2s_get_select_mandant_user AJAX handler located in includes/Ajax/Get.php. The handler accepts an arbitrary user ID in the owner parameter and resolves it to a display name without verifying that the caller has permission to read user account data. Any authenticated user with the edit_posts capability can invoke this handler to map WordPress user IDs to display names. The attack requires network access and a valid WordPress user account with at least editor-level permissions; no additional user interaction is needed. The vulnerability has been patched in version 9.1.0.

Affected products

Adenion Blog2Social before 9.1.0

Timeline

2026-09-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.