CVE-2025-13558: 
WordPress vulnerability analysis and mitigation

CVE-2025-13558 is a Missing Authorization vulnerability in the Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress, affecting all versions up to and including 8.7.0. The flaw allows authenticated attackers with Subscriber-level access or higher to change the status of arbitrary posts to trash via the unprotected deleteUserCcDraftPost function. It was published on November 25, 2025, and assigned a CVSS v3.1 base score of 5.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the deleteUserCcDraftPost AJAX function within the plugin's includes/Ajax/Post.php file. Because no authorization check validates whether the requesting user has permission to modify a given post, any authenticated WordPress user — even those with the lowest Subscriber role — can invoke this function and move arbitrary posts to the trash. The vulnerability is exploitable over the network with low privileges and requires no user interaction (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to move any post on the WordPress site to the trash, resulting in unauthorized data modification and potential availability disruption for site content. While there is no confidentiality impact (no data is exposed), the integrity and availability of published content are both affected, as posts can be effectively hidden or removed from public view without the site owner's knowledge (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.034%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low barrier to exploitation (only Subscriber-level authentication required) does increase theoretical risk on sites with open user registration (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Blog2Social plugin version 8.7.0 or earlier, using tools like WPScan or by checking the plugin's readme.txt file at wp-content/plugins/blog2social/readme.txt.
2. Obtain authentication: Register or log in as a Subscriber-level (or higher) user on the target WordPress site.
3. Identify target post IDs: Browse the site or use the WordPress REST API to enumerate published post IDs that the attacker wishes to trash.
4. Craft malicious AJAX request: Send an authenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to invoke deleteUserCcDraftPost and the target post ID as a parameter.
5. Achieve impact: The function executes without authorization validation, changing the status of the specified post to trash and removing it from public view (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to /wp-admin/admin-ajax.php with an action parameter related to deleteUserCcDraftPost from low-privileged user accounts.
• Database: Unexpected changes to post status (e.g., post_status = 'trash') in the wp_posts table for posts not intentionally deleted by administrators.
• Application Logs: WordPress debug logs or audit plugin logs recording invocations of the deleteUserCcDraftPost function by Subscriber-level users.

Users should update the Blog2Social plugin to version 8.7.1 or later, which introduces the missing capability check on the deleteUserCcDraftPost function (WordPress Trac). As an interim workaround, site administrators can disable open user registration to prevent untrusted users from obtaining Subscriber-level accounts, or temporarily deactivate the plugin until the update is applied. Regularly auditing post statuses and using a WordPress security or audit logging plugin can help detect unauthorized changes (Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for the period of November 24–30, 2025, and Sucuri included it in their November 2025 vulnerability patch roundup (Wordfence, Sucuri Blog). No significant broader media coverage or notable researcher commentary beyond these standard roundups has been observed.