10up Distributor EUVD-2026-103050

Requires an authenticated Contributor-level (or higher) account on a source WordPress site that has Distributor configured to push or pull content to a connected destination site; the attacker stores a serialized-PHP-shaped string as post meta that the vulnerable set_meta() then unserializes a second time on the destination. Meaningful impact is strictly gated by the presence of an exploitable PHP gadget (POP) chain in the destination site's loaded plugins/themes - without such a gadget, object instantiation has little effect. Limiting factors: authenticated Contributor privilege (PR:L), high attack complexity and a present attack requirement (AC:H/AT:P), a configured site-to-site distribution relationship, and the dependency on available gadget classes; affected versions are Distributor before 2.3.2.

This is a genuinely low-priority issue despite being a CWE-502 PHP object injection flaw. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N) scores only 2.3, and the signals are internally consistent: it is network-reachable but requires an authenticated Contributor-level account (PR:L), has high attack complexity (AC:H) and a present attack requirement (AT:P), and yields only Low confidentiality/integrity/availability impact with no scope change (SC:N/SI:N/SA:N). The critical mitigating factor is explicit in the description - impact 'depends on loaded gadget classes,' so without a usable POP gadget chain in the destination site's loaded code the injected object does nothing dangerous. No EPSS score, KEV listing, SSVC decision, or public POC is present in the provided data; there is no public exploit identified at time of analysis. The low-privilege-but-authenticated requirement plus gadget dependency explains the low rating - this is a defense-in-depth hardening fix rather than a widespread exploitation threat. No conflicting signals were observed; the CVSS network vector is reconcilable with the WordPress multisite push/pull distribution model, where a Contributor on one site causes code execution on a connected destination site.

An attacker with a Contributor account on a Distributor-connected source site stores a crafted serialized PHP string in a post's meta, then has that post distributed (pushed/pulled) to a destination site where set_meta() in includes/utils.php unserializes the already-unserialized value a second time, instantiating attacker-controlled objects. Meaningful harm occurs only if an exploitable gadget chain (POP chain) is present in the destination's loaded plugins/themes; absent a gadget, impact is limited. No public exploit code was identified at time of analysis.