CVE-2026-111628

MediumCVSS 5.0

Published: 16/10/2026(UTC)Updated: 23/10/2026(UTC)Translated: 17/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.

Risk Assessment

Potential code execution or other actions depending on available gadget classes — possible WordPress site takeover. Impact depends on loaded libraries, but risk is high in environments with vulnerable gadgets.

Recommendation

Upgrade the 10up Distributor plugin to version 2.3.2 or later. Restrict Contributor privileges if not essential and consider auditing code for unsafe deserialization.

Other vulnerabilities in 10up Distributor

CVE-2026-111625Medium
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS