CVE-2026-89029 describes an authorization bypass vulnerability in the Adenion Blog2Social WordPress plugin prior to version 9.1.0. The vulnerability exists in the b2s_get_select_mandant_user AJAX handler located in includes/Ajax/Get.php. This handler accepts an owner parameter representing user IDs and returns display names without verifying if the requesting user is authorized to access this information. Consequently, any user with the edit_posts capability can enumerate user IDs and obtain associated display names, confirming account existence.

The vulnerability enables low-privileged users (with edit_posts capability) to enumerate WordPress user accounts by mapping user IDs to display names. This information disclosure could aid attackers in reconnaissance activities but does not directly allow privilege escalation or data modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict edit_posts capability to trusted users only or disable the vulnerable AJAX handler if possible.