The Blog2Social plugin, a WordPress add‑on used for scheduling social media content, contains an authorization bypass that allows any authenticated user with Subscriber level or higher to change the schedule of posts belonging to other users. During the AJAX request, the plugin does not verify that the provided 'b2s_id' value belongs to the current user before performing the UPDATE or DELETE operation. This creates a classic Insecure Direct Object Reference flaw (CWE‑639) that can lead to unwanted reposting, rescheduling or deletion of posts, thereby compromising the organization’s social media integrity.

Affected systems include any WordPress installation running Blog2Social plugin version 8.8.3 or earlier. The vulnerability is present in all releases up to and including 8.8.3, regardless of the operating environment. There are no additional external dependencies listed beyond the plugin itself.

The vulnerability carries a CVSS score of 4.3, indicating moderate severity. Because an attacker must first authenticate with a WordPress account that has at least Subscriber role, the exploitation window is limited to sites with widespread or easily compromised credentials. The EPSS score is not available, and the flaw is not currently catalogued in CISA’s KEV list. The likely attack path requires a valid login, selection of a target post, and submission of the 'b2s_id' parameter with an ID that does not belong to the logged‑in user.