CVE-2026-4330 is an authorization bypass vulnerability in the Blog2Social WordPress plugin caused by improper validation of the 'b2s_id' parameter in AJAX handlers. The plugin fails to confirm ownership of the 'b2s_id' before performing UPDATE and DELETE operations on scheduled posts. This flaw allows authenticated users with low privileges (Subscriber and above) to manipulate other users' scheduled social media posts, violating access controls. The vulnerability affects all versions up to and including 8.8.3. The CVSS 3.1 base score is 4.3, reflecting a medium severity with low attack complexity and limited impact on integrity only.

An attacker with authenticated access at Subscriber level or higher can bypass authorization controls to modify or delete scheduled social media posts of other users. This impacts the integrity of scheduled content but does not affect confidentiality or availability. There is no indication of known exploits in the wild. The vulnerability could lead to unauthorized content manipulation within affected WordPress sites using this plugin.

Patch status is not yet confirmed — no official fix or patch links are provided in the available data. Users should monitor the vendor's advisory for updates and apply any official patches once released. Until then, consider restricting plugin usage to trusted users or disabling the plugin if possible to prevent exploitation.