The Blog2Social plugin, a WordPress extension for auto‑posting to social media, contains a flaw where the uploadVideo() function checks the user capability incorrectly. Consequently, any authenticated user with Subscriber or higher role can upload MP4 files to the wp‑content/uploads folder, potentially leading to unauthorized content placement on the site. This allows attackers to alter site media storage, hide malicious content, or exploit other weaknesses relying on the presence of uploaded files. The weakness is a classic example of incorrect authorization and is classified as CWE‑862.

All WordPress installations running Blog2Social version 8.6.0 or earlier are impacted. This includes any site that has installed the plugin without updating to a newer release that removes the capability check. Site administrators should verify the currently installed plugin version and ensure it is at 8.6.1 or higher.

The CVSS base score of 4.3 indicates moderate severity. With an EPSS score of less than 1%, the likelihood of exploitation is extremely low at present. The vulnerability is not listed in the CISA KEV catalog, reducing its prominence. The attack vector requires authenticated access; therefore, users with Subscriber privileges can abuse the flaw. In practice, exploitation would involve uploading an MP4 file to the uploads directory, which may then be accessed publicly or used in further attacks if the site's security posture is otherwise weak.