Is CVE-2026-92829 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92829 being exploited in the wild.

How severe is CVE-2026-92829?

Medium severity, with a CVSS score of 4.3, published 25 September 2026.

Which products and versions are affected?

Blog2Social: Social Media Auto Post & Scheduler up to and including 9.1.0.

Is there a fix for CVE-2026-92829?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92829 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-92829?

Check whether you run Blog2Social: Social Media Auto Post & Scheduler at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92829: Blog2Social Social Media Auto Post & Scheduler authorization bypass

CVE-2026-92829 · Severity: medium · CVSS 4.3 · Published 2026-09-25

The Blog2Social plugin for WordPress contains an authorization bypass flaw that allows authenticated users with contributor-level access to view, modify, and delete other users' social media records and scheduled posts. An attacker could exploit this to access other users' social network authentication credentials, modify post metadata on content they do not own, rebind social account authorizations, and hide posts across the site.

Technologies: Blog2Social: Social Media Auto Post & Scheduler. Vendors: Blog2Social.

Quick answers

Is CVE-2026-92829 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92829 being exploited in the wild.
How severe is CVE-2026-92829?: Medium severity, with a CVSS score of 4.3, published 25 September 2026.
Which products and versions are affected?: Blog2Social: Social Media Auto Post & Scheduler up to and including 9.1.0.
Is there a fix for CVE-2026-92829?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92829 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-92829?: Check whether you run Blog2Social: Social Media Auto Post & Scheduler at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin fails to properly verify user authorization before allowing actions on Blog2Social records. The b2s_security_nonce is exposed in the post-edit meta box, making it available to any authenticated user with contributor-level access or above. This enables authenticated attackers to perform unauthorized modifications to other users' social media integrations, scheduled posts, and post metadata through the plugin's AJAX endpoints.

Affected products

Blog2Social Social Media Auto Post & Scheduler up to and including 9.1.0

Timeline

2026-09-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.