The Blog2Social plugin for WordPress contains a missing capability check on the deleteUserCcDraftPost function. As a result, any authenticated user with Subscriber level or higher can invoke this AJAX action and change the status of any post to trash. This flaw permits unauthorized deletion or defacement of content without requiring elevated privileges. The weakness is classified as Missing Authorization (CWE-862).

All installations of Blog2Social for WordPress up to and including version 8.7.0 are affected. Users running these versions should confirm their deployed plugin version and plan an upgrade accordingly.

The CVSS score of 5.4 indicates moderate severity, but the EPSS score of less than 1% suggests a very low current probability of exploitation. Attackers need only authentication with Subscriber-level access or higher to trigger the vulnerability. The lack of a required high-level privilege and the absence in the CISA KEV list reduce the immediate threat, yet the potential to erase or disrupt content makes it worth addressing promptly.