The vulnerability lies in the resetSocialMetaTags() function, which only checks for a generic 'read' capability and a nonce. Because all WordPress roles receive the plugin’s 'blog2social_access' capability, authorized subscribers can invoke the AJAX action that deletes every _b2s_post_meta record. The result is a loss of custom social media meta data for all posts, damaging the site’s social sharing configuration and potentially breaking cross‑platform integrations. No code execution or data exfiltration is possible, but the integrity of post metadata is compromised.

The issue affects the Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress in all releases up to and including 8.8.2. Users of any role who have basic read permissions can exploit the flaw because the plugin grants access to its admin pages on activation.

The CVSS score of 4.3 indicates moderate severity, and the attack requires a logged‑in user with at least subscriber level rights. Because the vulnerability depends on a legitimate AJAX endpoint that accepts a valid nonce, the exploitation cost is low for authenticated users. No EPSS data or KEV listing is available, but the weakness (CWE‑862) is widely known and could be abused by attackers with common access privileges.