Executive brief
Blog2Social is a WordPress plugin that automatically shares website content to social media platforms. A vulnerability in versions before 9.1.0 allows any WordPress user with basic posting capabilities to retrieve and view the email addresses of all registered users on the site, including administrators. This exposes sensitive contact information that could be used for targeted phishing, social engineering, or account takeover attacks.
Technical details
The vulnerability is an authorization bypass (CWE-862) in the AJAX handler b2s_search_user located in includes/Ajax/Get.php. This handler calls B2S_Tools::searchUser() in includes/Tools.php, which returns email addresses for matching users without verifying that the caller possesses the list_users capability. Any authenticated user with edit_posts capability (typically Authors and Editors) can invoke this AJAX endpoint over the network to enumerate and retrieve email addresses of all WordPress users, including privileged administrators. The vulnerability was patched in version 9.1.0.
Affected products
- Adenion Blog2Social before 9.1.0
Timeline
- 2026-09-16: disclosed