CVE-2025-14943

CVSS 4.3 Medium
  • CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • Published: 2026-01-10T07:16:02.343

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.7.2. This is due to a misconfigured authorization check on the ‘getShipItemFullText’ function which only verifies that a user has the ‘read’ capability (Subscriber-level) and a valid nonce, but fails to verify whether the user has permission to access the specific post being requested. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract data from password-protected, private, or draft posts.

Related CVE by CWE

No related CWE found.

Top CVE for Vendor

No vendor taxonomy on this entry.

Recently Exploited Similar Vulnerabilities

No recent KEV-listed items for this vendor/product.

How to fix CVE-2025-14943

CVE-2025-14943 is a medium severity vulnerability affecting the affected product.

Description: The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.7.2. This is due to a misconfigured authorization check on the ‘getShipItemFullText’ function which only verifies that a user has the ‘read’ capability (Subscriber-level) and a valid nonce, but fails to […]

Affected Versions:
❌ Vulnerable: ≤ 8.7.2
✅ Safe: ≥ 8.7.3

Exploit Difficulty: EASY
⏱️ Time to exploit: < 1 hour
🛠️ Required skills: Basic web security knowledge
💰 Public exploits: Likely available

How to Fix:

1 Identify affected systems

- Check if you're running the affected product
- Verify version (vulnerable: ≤ 8.7.2)

2 Immediate actions

- Update to ≥ 8.7.3 or later
- If patching is not immediately possible: restrict network exposure, apply least-privilege access

3 Verification

- Test the fix in a staging environment first
- Review logs for signs of exploitation
- Monitor for IOCs (Indicators of Compromise)

4 Long-term prevention

- Enable automatic security updates
- Set up vulnerability monitoring
- Review and harden security configurations

Exploit Difficulty Assessment

EASY
⏱️ Time to Exploit: < 1 hour
🛠️ Skills Required: Basic web security knowledge
💰 Public Exploits: Likely available

Affected Versions

❌ Vulnerable: ≤ 8.7.2
✅ Safe: ≥ 8.7.3

Vulnerability Timeline

Jan 10, 2026
Vulnerability Published

CVE details first published to NVD database

Jan 10, 2026
Imported to Database

Added to this CVE tracking system

Detection Rules & IOCs

No specific detection rules generated for this vulnerability type.

No vendor/product data available.