The Blog2Social plugin contains a misconfigured authorization check that allows any authenticated user with Subscriber or higher capability to retrieve the full text of private, password-protected, or draft posts. This results in confidential post content being exposed to unauthorized users. The weakness is classified as CWE‑863, an authorization bypass that compromises the confidentiality of content stored in WordPress. The vulnerability cannot be exploited for code execution, but it permits privileged information disclosure that could aid phishing or business intelligence leaks.

Any installation of the Blog2Social: Social Media Auto Post & Scheduler WordPress plugin up to and including version 8.7.2 is affected. The issue is present in all prior releases of the plugin that have not applied the patch delivered in newer versions.

The CVSS score of 4.3 indicates a low‑to‑moderate risk, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Attackers must first authenticate to WordPress with at least Subscriber‑level credentials. Once authenticated, they can retrieve the contents of any post marked as private or draft from the plugin’s endpoint. Since the plugin verifies only a basic 'read' capability and a nonce, the lack of a per‑post authorization check is the core issue.