Distributor CVE-2026-111631

Requires an authenticated WordPress account with at least Contributor-level privileges on a site running Distributor before 2.3.2; the vulnerable dt_verify_external_connection and dt_begin_authorization AJAX handlers failed to enforce the intended manage_options capability, checking only edit_posts/read-level access. For credential exfiltration via dt_verify_external_connection, the site must already have a configured external connection (post type dt_ext_connection) holding stored credentials, and the attacker supplies a chosen endpointId plus an attacker-controlled url. Limiting factors: exploitation is not anonymous (a valid low-privilege login is required), it is ineffective on installs with no pre-existing external connections to exfiltrate, and sites with no untrusted Contributor-level users have no exposed attack surface.

This is a genuine but moderate-priority issue rather than a critical emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N, score 5.3) is internally consistent with the description: exploitation is network-reachable over WordPress AJAX, low complexity, but requires an authenticated low-privilege (PR:L) Contributor account rather than being anonymous. The principal risk is confidentiality - a low-trust user can coerce the plugin into transmitting stored external-connection credentials to an attacker-controlled host (credential exfiltration / lateral-movement enabler) - plus limited integrity impact via unauthorized connection creation through dt_begin_authorization. Mitigating the severity: there is no CISA KEV listing (not confirmed actively exploited), no public exploit code identified in the provided data, and no EPSS score was supplied, so exploitation probability cannot be quantified from this input. The realistic risk concentrates in multi-author WordPress installations that run Distributor < 2.3.2 AND have Contributor-level accounts AND have already configured external connections with stored credentials; in single-admin sites the PR:L prerequisite and absence of such accounts substantially reduce exposure. Net: a real authorization flaw worth patching promptly where untrusted contributors exist, but not an internet-wide drop-everything threat.

A multi-author publishing site runs Distributor before 2.3.2 and has previously configured an external connection with stored credentials. A malicious or compromised Contributor-level account calls the dt_verify_external_connection AJAX action with a chosen endpointId and an attacker-controlled url, causing the plugin to send the stored connection credentials to the attacker's server. No public proof-of-concept exploit was identified in the provided data; the attack requires only a valid low-privilege login and network access.