CVE-2026-111625

15th percentile - higher than 15% of all known CVEs

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.

Unauthorized content creation on other sites in the multisite network — ability to publish malicious or false information. Violates integrity and trust in content across the network.

Upgrade the 10up Distributor plugin to version 2.3.2 or later. Restrict Contributor privileges in the multisite network and monitor unusual publishing activity.