The vulnerability allows an authenticated attacker with Subscriber-level access or higher to inject SQL code via the ‘prgSortPostType’ parameter of the Blog2Social plugin. This permits the attacker to append malicious queries to the plugin’s existing SQL, resulting in unintended data disclosure from the WordPress database. The weakness is a classic SQL injection (CWE‑89).

WordPress sites running the Blog2Social Social Media Auto Post & Scheduler plugin version 8.4.4 or earlier are affected. The affected product is the plugin itself; any installation of version 8.4.4 or earlier on a WordPress instance is vulnerable.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% signposts a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be logged into WordPress with at least Subscriber privileges and to manipulate the prgSortPostType parameter in a request to the plugin’s endpoint. While the description does not explicitly state the attack vector, it is inferred that the injection can occur via a crafted URL or form submission accessible to authenticated users. Once exploited, the attacker can read sensitive information such as user credentials and site metadata from the database.