Distributor
Monthly
Missing authorization in the 10up Distributor WordPress plugin before 2.3.2 allows authenticated users with Contributor-level privileges to invoke AJAX handlers that were intended only for administrators, enabling them to send stored external-connection credentials to an attacker-controlled server via dt_verify_external_connection or to create new external connections via dt_begin_authorization. Exploitation requires a valid low-privilege login (CVSS vector PR:L, so authenticated, not anonymous), and the credential-theft path only works on sites that already have a configured external connection holding stored credentials; sites without pre-existing connections or without untrusted Contributor-level accounts have no exposed attack surface. No public exploit has been identified at time of analysis, and the vendor has released a fix in version 2.3.2.
PHP object injection in 10up Distributor before 2.3.2 allows an authenticated Contributor-level user on a connected source WordPress site to store a serialized-PHP-shaped string as post meta, which the destination site's set_meta() function in includes/utils.php then unserializes a second time, instantiating attacker-influenced objects on the receiving site. Real-world impact is heavily gated: exploitation requires a configured Distributor push/pull relationship between two sites and a usable PHP gadget (POP) chain in the destination's loaded plugins or themes, otherwise object instantiation accomplishes little. Tracked as CWE-502 with a CVSS 4.0 base score of 2.3 (independent assessment: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) and no public exploit identified at time of analysis, this is a low-priority hardening issue rather than an urgent, actively exploited flaw.
Authenticated Contributor-level users on a WordPress multisite network running 10up Distributor before 2.3.2 can create draft or published posts on network sites they do not have access to by invoking the dt-push AJAX action with a chosen connection ID and postStatus. The flaw is a moderate-severity missing authorization condition in ajax_push() (CWE-862) and is limited to multisite installations; single-site WordPress installs are not exploitable, and super admins are out of scope. Vendor-released patch: 2.3.2; no public exploit identified at time of analysis.
Missing authorization in the 10up Distributor WordPress plugin before 2.3.2 allows authenticated users with Contributor-level privileges to invoke AJAX handlers that were intended only for administrators, enabling them to send stored external-connection credentials to an attacker-controlled server via dt_verify_external_connection or to create new external connections via dt_begin_authorization. Exploitation requires a valid low-privilege login (CVSS vector PR:L, so authenticated, not anonymous), and the credential-theft path only works on sites that already have a configured external connection holding stored credentials; sites without pre-existing connections or without untrusted Contributor-level accounts have no exposed attack surface. No public exploit has been identified at time of analysis, and the vendor has released a fix in version 2.3.2.
PHP object injection in 10up Distributor before 2.3.2 allows an authenticated Contributor-level user on a connected source WordPress site to store a serialized-PHP-shaped string as post meta, which the destination site's set_meta() function in includes/utils.php then unserializes a second time, instantiating attacker-influenced objects on the receiving site. Real-world impact is heavily gated: exploitation requires a configured Distributor push/pull relationship between two sites and a usable PHP gadget (POP) chain in the destination's loaded plugins or themes, otherwise object instantiation accomplishes little. Tracked as CWE-502 with a CVSS 4.0 base score of 2.3 (independent assessment: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) and no public exploit identified at time of analysis, this is a low-priority hardening issue rather than an urgent, actively exploited flaw.
Authenticated Contributor-level users on a WordPress multisite network running 10up Distributor before 2.3.2 can create draft or published posts on network sites they do not have access to by invoking the dt-push AJAX action with a chosen connection ID and postStatus. The flaw is a moderate-severity missing authorization condition in ajax_push() (CWE-862) and is limited to multisite installations; single-site WordPress installs are not exploitable, and super admins are out of scope. Vendor-released patch: 2.3.2; no public exploit identified at time of analysis.