The Blog2Social plugin for WordPress suffers from a missing authorization (CWE-862) in the uploadVideo() function, which incorrectly checks user capabilities. This flaw allows authenticated users with low privilege (Subscriber-level and above) to upload mp4 files into the 'wp-content/uploads/<YYYY>/<MM>/' directory. The vulnerability is present in all versions up to 8.6.0. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low complexity, and low privileges required, with no user interaction needed. The impact is limited to integrity, with no confidentiality or availability impact reported. No known exploits are currently in the wild, and no patch or vendor advisory is provided.

Authenticated users with Subscriber-level access or higher can upload mp4 files to the WordPress uploads directory without proper authorization checks. This could allow unauthorized content to be placed on the server, potentially leading to integrity issues such as hosting malicious or unwanted media files. There is no reported impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting upload permissions for Subscriber-level users or disabling the uploadVideo() functionality if possible. Monitor plugin updates from the vendor and apply patches promptly once released.