10up Distributor CVE-2026-111625

Requires a WordPress MULTISITE network running 10up Distributor before 2.3.2, and the attacker must already hold a valid low-privilege (Contributor-level) account on at least one network site to obtain the dt-push nonce. The vulnerable path is ajax_push() in includes/push-ui.php, which failed to call current_user_can('edit_post') on the source post or to check publish_posts/create_posts capabilities on the destination blog before switch_to_blog(). Limiting factors: exploitation is impossible on single-site (non-multisite) WordPress installs, requires an authenticated session plus a valid dt-push nonce, and super-admins are out of scope since the check only gates non-super-admin users; impact is limited to creating content (integrity) on other network sites, with no data disclosure or denial of service.

This is a moderate-severity authorization flaw (CWE-862) in the 10up Distributor WordPress plugin, and the available signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N, base 5.3) indicates a network-reachable but authenticated attack requiring only low privileges (a Contributor account) with no user interaction, and the impact is confined to integrity - the attacker can create draft or published posts on other network sites but cannot read data (VC:N) or affect availability (VA:N). There is no CISA KEV listing and no EPSS score or public POC referenced in the supplied data, so per precision rules this is 'no public exploit identified at time of analysis'; the finding was reported by VulnCheck with a GitHub Security Advisory (GHSA-26j8-r2m4-768c) and a confirmed patch. No SSVC decision data was provided. Net assessment: this is a real but bounded privilege-escalation/cross-site-content issue, NOT a critical remote-code-execution emergency - it matters specifically to multisite WordPress networks that grant untrusted users Contributor-level accounts, and is low priority for single-site installations. EPSS and KEV are both absent, which is consistent with a newly disclosed, patched, non-weaponized flaw rather than a conflict.

An attacker holding a Contributor account on one site of a WordPress multisite network running Distributor before 2.3.2 crafts an AJAX request to the dt-push action, supplying a valid dt-push nonce, a chosen destination connection id, and a postStatus value. Because ajax_push() never verified the user's capabilities on the destination site, the request creates a draft or published post on a network site the attacker has no access to. No public exploit code is identified at time of analysis, but the attack is simple to reproduce from the source diff.