CVE-2026-92829 is an authorization bypass vulnerability (CWE-862) in the Blog2Social: Social Media Auto Post & Scheduler WordPress plugin affecting all versions up to and including 9.1.0. The plugin fails to properly verify that users are authorized to perform certain actions, allowing authenticated users with contributor-level privileges or higher to access and manipulate other users' Blog2Social data. The b2s_security_nonce is exposed in the post-edit meta box, which contributors can render, enabling exploitation of this flaw to view or modify other users' scheduled posts, network authentication IDs, and social media metadata.

The vulnerability allows authenticated users with contributor-level access or above to bypass authorization controls. They can view, modify, or delete other users' Blog2Social records, disclose sensitive network authentication IDs, overwrite Open Graph and Twitter Card metadata on posts they do not own, rebind social-network authorizations for other users, and mass-hide scheduled posts across the site. This leads to unauthorized data disclosure and integrity issues within the plugin's social media scheduling features.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access where possible and monitor for suspicious activity related to Blog2Social plugin usage. Avoid granting contributor or higher privileges to untrusted users.