CVE-2026-111628: 10up Distributor

Medium severity, CVSS 5.0. EPSS: 0.3% chance of exploitation in the next 30 days.

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.

Affected products

• 10up Distributor: before 2.3.2 (fixed in 2.3.2)

Published 2026-10-16. Last modified 2026-10-16.