What’s Vulnerable › Vulnerabilities

CVE-2026-89030: Blog2Social WordPress Plugin < 9.1.0 User Email Disclosure via b2s_search_user

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-16 · updated 2026-09-24
• Weakness: CWE-862

Description

Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2s_search_user AJAX handler in includes/Ajax/Get.php invokes B2S_Tools::searchUser() in includes/Tools.php, which returns the email address of every matching user without restricting access to callers holding the list_users capability, allowing any user with the edit_posts capability to retrieve user email addresses including those of administrators.

Affected products

• pr-gateway Blog2Social: Social Media Auto Post & Scheduler: before 9.1.0 — fixed in 9.1.0

How to fix

Upgrade to a fixed version: pr-gateway Blog2Social: Social Media Auto Post & Scheduler 9.1.0. Check the vendor advisory for mitigations.

References

• https://wordpress.org/plugins/blog2social/#developers
• https://www.vulncheck.com/advisories/blog2social-wordpress-plugin-user-email-disclosure-via-b2s-search-user

Get alerted when CVE-2026-89030 or the next vulnerability affects your stack