The Blog2Social plugin for WordPress permits an authenticated user with a Subscriber-level role to alter the title and content of any post or page. This occurs because the b2s_curation_draft AJAX action checks only that the user can read, without verifying that the user has edit permission for the target post. The plugin’s UI exposes a nonce that is available to all roles, enabling a legitimate user to send a crafted request that overwrites any post data, leading to unauthorized data modification or defacement.

The vulnerability impacts the Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress, versions up to and including 8.7.4. No further sub‑version details are provided, so any installation running a vulnerable release must be reviewed.

The CVSS score of 6.5 indicates moderate severity. EPSS is less than 1%, so the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. However, because an attacker only needs a default authenticated role, the risk is real for sites with many Subscriber users. An attacker could hijack multiple posts, spread malicious content, or tamper with site information.