Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-89029: Blog2Social plugin lets low-level users discover account names
CVE-2026-89029 · published 1 month ago
Summary
The Blog2Social WordPress plugin (versions before 9.1.0) lets anyone who can edit posts look up the display names of any WordPress user by guessing their ID. This means an attacker could confirm whether particular user accounts exist, which can aid further attacks. Update the plugin to the latest version or restrict the edit_posts capability to trusted users.
What to do
- Update adenion blog2social to version 9.1.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| adenion | blog2social | < 9.1.0 |
Original advisory text
Blog2Social WordPress Plugin < 9.1.0 User Enumeration via AJAX Handler
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller is authorized to read user account data, allowing any user with the edit_posts capability to map WordPress user IDs to display names and confirm account existence for arbitrary IDs.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published16 Sep 2026
Updated3 Nov 2026
First seen16 Sep 2026
Track software like this
Free during beta