CVE-2026-111625: 10up Distributor

Medium severity, CVSS 5.0. EPSS: 0.2% chance of exploitation in the next 30 days.

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.

Affected products

• 10up Distributor: before 2.3.2 (fixed in 2.3.2)

Published 2026-10-16. Last modified 2026-10-16.