CVE-2026-1942

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the b2s_curation_draft AJAX action in all versions up to, and including, 8.7.4. The curationDraft() function only verifies current_user_can('read') without checking whether the user has edit_post permission for the target post. Combined with the plugin granting UI access and nonce exposure to all roles, this makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the title and content of arbitrary posts and pages by supplying a target post ID via the 'b2s-draft-id' parameter.

• CWE-862

• https://plugins.trac.wordpress.org/browser/blog2social/tags/8.7.3/includes/Ajax/Post.php#L159
• https://plugins.trac.wordpress.org/browser/blog2social/tags/8.7.3/includes/B2S/Curation/Save.php#L39
• https://plugins.trac.wordpress.org/browser/blog2social/trunk/includes/Ajax/Post.php?rev=3462464
• https://www.wordfence.com/threat-intel/vulnerabilities/id/930e7fd6-ae0b-465a-aa93-04ef80011d32?source=cve

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19410An Incorrect Authorization vulnerability in GitHub Trigger C…9.4
• CVE-2026-19411A NULL pointer vulnerability has been found in the the shim …3.9
• CVE-2026-19412This vulnerability exists in the CP Plus CP-XR-DE21-S Router…8.7
• CVE-2026-19416The KiviCare WordPress plugin before 4.5.4 does not verify …4.3
• CVE-2026-19417The KiviCare WordPress plugin before 4.5.4 does not verify …6.5
• CVE-2026-19418The referrer enforcement introduced with TYPO3-CORE-SA-2020-…7.3
• CVE-2026-19423The Ultimate Member WordPress plugin before 2.13.0 does not…8.1
• CVE-2026-19424Chiline Cloud developed by Inventec Appliances has a Insecur…7.5
• CVE-2026-19425Travel Agency Management System developed by Win Men Interma…9.8
• CVE-2026-19426POS System developed by FitSoft has a Missing Authentication…8.2
• CVE-2026-19429Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-1943The YayMail – WooCommerce Email Customizer plugin for WordPr…4.4