The Blog2Social WordPress plugin contains a missing ownership verification in its delete functions. When an authenticated user supplies a post identifier, the plugin does not verify that the post belongs to that user, enabling the attacker to soft‑delete any user’s social media post record. The impact is the loss of scheduled or published content from other users, potentially disrupting collaborative publishing workflows. This flaw is a classic example of missing authorization (CWE-862).

WordPress sites that have installed Blog2Social Social Media Auto Post & Scheduler up to and including version 8.9.0 are affected. All users with authenticated access through the plugin can exploit the weakness, regardless of the site’s size or number of users.

The CVSS score of 5.4 indicates a moderate severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs valid login credentials to invoke the delete endpoint or API call; no additional privileges or advanced techniques are required. The risk is confined to authenticated users, but any such user could delete posts belonging to other users.