CVE-2026-7051: Missing Authorization in Blog2Social

The core of this vulnerability lies in the B2SPostTools::deleteUserPublishPost() and B2SPostTools::deleteUserSchedPost() functions. These functions lack proper ownership verification when deleting posts, meaning an attacker with valid WordPress authentication can manipulate the postId parameter to target and delete any user's post records. This bypasses intended access controls, granting unauthorized deletion capabilities. The impact is significant as it allows for targeted data removal, potentially disrupting a website's social media presence and impacting user trust. While requiring authentication, the ease of exploitation makes it a concerning risk.

1. 已保留2026-04-25
2. 发布日期2026-05-12
3. 修改日期2026-05-13

The primary mitigation is to immediately upgrade the Blog2Social plugin to version 8.9.1 or later, which includes the necessary authorization checks. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider restricting access to the plugin's administrative functions. Implement a Web Application Firewall (WAF) rule to block requests containing suspicious postId values or patterns indicative of unauthorized deletion attempts. Regularly review WordPress user permissions and ensure that only authorized personnel have access to administrative functions. After upgrading, confirm the fix by attempting to delete a post as a user other than the administrator to verify that access controls are properly enforced.