10up Distributor vulnerabilities

3 CVEs affecting 10up Distributor, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-111631, published 2026-10-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-111628, published 2026-10-16. Medium severity, CVSS 5.0. EPSS: 0.3% chance of exploitation in the next 30 days. 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can…
CVE-2026-111625, published 2026-10-16. Medium severity, CVSS 5.0. EPSS: 0.2% chance of exploitation in the next 30 days. 10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use…
CVE-2026-111631, published 2026-10-16. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can…