Executive brief
Blog2Social is a WordPress plugin that automates posting content to social media platforms. The plugin fails to properly verify user permissions in an AJAX handler, allowing any user with basic posting rights to discover the names and IDs of all WordPress user accounts on the site. An attacker with a low-privilege account could systematically enumerate all site users and confirm their existence, which could facilitate further targeted attacks.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the b2s_get_select_mandant_user AJAX handler located in includes/Ajax/Get.php. The handler accepts an arbitrary user ID in the owner parameter and resolves it to a display name without verifying that the caller has permission to read user account data. Any authenticated user with the edit_posts capability can invoke this handler to map WordPress user IDs to display names. The attack requires network access and a valid WordPress user account with at least editor-level permissions; no additional user interaction is needed. The vulnerability has been patched in version 9.1.0.
Affected products
- Adenion Blog2Social before 9.1.0
Timeline
- 2026-09-16: disclosed