CVE-2026-4330 is an authorization bypass vulnerability in the Blog2Social: Social Media Auto Post & Scheduler WordPress plugin. The flaw arises from insufficient validation of the 'b2s_id' parameter in AJAX handlers, which allows authenticated users with low privileges to perform unauthorized update and delete actions on other users' scheduled posts. This vulnerability is present in all versions up to and including 8.8.3. The CVSS 3.1 base score is 4.3, reflecting a medium severity with low complexity and requiring authenticated user privileges.

Exploitation of this vulnerability allows authenticated users with Subscriber-level access or above to modify or delete scheduled social media posts of other users. This could disrupt social media management workflows and cause unauthorized changes to scheduled content. There is no impact on confidentiality or availability, only integrity is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restrict user roles carefully and monitor for suspicious activity related to scheduled posts. Avoid granting unnecessary Subscriber-level or higher access to untrusted users.