Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: 10up Distributor 2.3.2 Clear all filters
TI-2026-75417 CVE-2026-111631 · GHSA-xxvq-6crw-36jx

Missing authorization in Distributor external connection AJAX actions

Priority LOW 24

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00235 Published 2026-10-16 Fixed in 2.3.2 CWE-862
TI-2026-75414 CVE-2026-111628 · GHSA-p88q-h74f-qxvq

PHP object injection in 10up Distributor via set_meta()

Priority LOW 12

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-10-16 Fixed in 2.3.2 CWE-502
TI-2026-75411 CVE-2026-111625 · GHSA-wgfj-q3jr-6q45

10up Distributor missing authorization lets contributors publish elsewhere

Priority LOW 24

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00246 Published 2026-10-16 Fixed in 2.3.2 CWE-862