CVE-2026-111625 Details
Description
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.
A missing authorization vulnerability has been identified in the 10up Distributor plugin, versions prior to 2.3.2. This vulnerability allows Contributor-level users in a multisite environment to publish posts on other network sites. The issue arises because the ajax_push() function does not properly verify user permissions before allowing post creation. Exploitation involves sending an AJAX request to the push endpoint with a selected connection ID and post status, using the dt-push nonce. As a result, users can create draft or published posts on sites where they lack access rights.
Users are advised to upgrade to Distributor version 2.3.2, which addresses this vulnerability by implementing the necessary authorization checks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 10up Distributor | <= 2.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |