Exploitation Research Plan: CVE-2026-7051 (Blog2Social IDOR)

1. Vulnerability Summary

The Blog2Social plugin (up to 8.9.0) contains an Insecure Direct Object Reference (IDOR) vulnerability in its post-deletion functions. The functions B2S_Post_Tools::deleteUserPublishPost() and B2S_Post_Tools::deleteUserSchedPost() handle the deletion (soft-deletion via a hide flag) of social media post records stored in the wp_b2s_posts table. These functions fail to verify if the requesting user owns the record being deleted, allowing any authenticated user (Subscriber level and above) to delete arbitrary records by providing their numeric ID.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Actions:
  • b2s_delete_user_publish_post (for published posts)
  • b2s_delete_user_sched_post (for scheduled posts)
• HTTP Method: POST
• Payload Parameter: postId (likely an array or single integer, handled in B2S_Post_Tools as an array)
• Authentication: Authenticated (Subscriber+)
• Preconditions:
  • The attacker must have a valid session.
  • A valid b2s_security_nonce must be obtained.
  • The target wp_b2s_posts.id must be known or guessed (sequential).

3. Code Flow

1. Entry Point: A POST request is sent to admin-ajax.php with action=b2s_delete_user_publish_post.
2. AJAX Routing: includes/Ajax/Post.php registers the action:

   add_action('wp_ajax_b2s_delete_user_publish_post', array($this, 'deleteUserPublishPost'));
   

3. AJAX Handler: Ajax_Post::deleteUserPublishPost() (wrapper) extracts the postId and calls the logic tool.
4. Vulnerable Logic (Sink): includes/B2S/Post/Tools.php:

   public static function deleteUserPublishPost($postIds = array()) {
       global $wpdb;
       // ...
       foreach ($postIds as $v) {
           // VULNERABLE: No blog_user_id check in this query
           $row = $wpdb->get_row($wpdb->prepare("SELECT id,v2_id,post_id FROM {$wpdb->prefix}b2s_posts WHERE id =%d", (int) $v));
           if (isset($row->id) && (int) $row->id == $v) {
               // Soft delete by setting 'hide' to 1
               $wpdb->update($wpdb->prefix.'b2s_posts', array('hook_action' => $hook_action, 'hide' => 1), array('id' => $v));
               // ...
           }
       }
   }
   

   The query only checks if the record exists by ID. It does not verify the blog_user_id column against get_current_user_id().

4. Nonce Acquisition Strategy

The plugin uses a global nonce b2s_security_nonce. This nonce is frequently localized for use in the admin dashboard and Blog2Social-specific pages.

1. Check Availability: The nonce is generated for the action string 'b2s_security_nonce'.
2. Identification: In assets/js/b2s/general.js, the nonce is accessed via jQuery('#b2s_security_nonce').val().
3. Strategy:
   • Log in as a Subscriber.
   • Navigate to the WordPress Dashboard (/wp-admin/index.php) or any B2S page if accessible.
   • If the plugin enqueues its scripts for all authenticated users, the nonce will be in the HTML.
   • Use browser_eval to search for the hidden input:
     browser_eval("document.getElementById('b2s_security_nonce')?.value")
   • Alternatively, check for localized objects in the page source like b2s_security_nonce.

5. Exploitation Strategy

Step 1: Discover Target ID

Since IDs in wp_b2s_posts are sequential, an attacker can brute-force IDs. For a PoC, we will create a post as Admin and identify its ID in the database.

Step 2: Request Deletion

Send the following request using the http_request tool:

Request Details:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=b2s_delete_user_publish_post&postId[]=TARGET_ID&b2s_security_nonce=VALID_NONCE
  

  (Note: If postId[] fails, try postId=TARGET_ID as the description implies a single parameter, but the code handles an array).

6. Test Data Setup

1. Admin User: Log in as Admin.
2. Create Post: Create a standard WordPress post.
3. Blog2Social Action: Use the Blog2Social "Site Sharing" feature to "Share on Networks". This will create an entry in the wp_b2s_posts table.
4. Identify ID:

   wp db query "SELECT id FROM wp_b2s_posts ORDER BY id DESC LIMIT 1;"
   

5. Subscriber User: Create a user with the subscriber role.

7. Expected Results

• Response: The server should return a JSON response: {"result": true, "postId": [TARGET_ID], ...}.
• Database Change: The record in wp_b2s_posts with id = TARGET_ID should now have the hide column set to 1.

8. Verification Steps

After the exploit request, use WP-CLI to verify the "soft delete" state:

wp db query "SELECT id, hide FROM wp_b2s_posts WHERE id = TARGET_ID;"

If successful, the output will show hide as 1.

9. Alternative Approaches

If b2s_delete_user_publish_post is restricted by capability checks in the AJAX wrapper (not visible in truncated source), try the scheduled post endpoint:

• Action: b2s_delete_user_sched_post
• Constraint: The record must have publish_date = '0000-00-00 00:00:00' to pass the SELECT query in deleteUserSchedPost.

If the Subscriber cannot see the nonce on the default dashboard, navigate to:

• /wp-admin/admin.php?page=blog2social (if permitted)
• Or inspect the Profile page to see if scripts are loaded.