The Blog2Social plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) due to insufficient escaping and lack of prepared statements on the 'b2sSortPostType' parameter. Authenticated attackers with low privileges can append arbitrary SQL commands to existing queries, enabling unauthorized data access. The vulnerability is present in all versions up to 7.4.1. The CVSS v3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, and privileges required at the subscriber level. No official patch or vendor advisory is provided in the input data.

Successful exploitation allows an authenticated user with subscriber-level privileges to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure of sensitive information, modification or deletion of data, and potential full compromise of the affected WordPress installation's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to the 'b2sSortPostType' parameter. Avoid using affected versions of the plugin in sensitive environments.