CVE-2026-111625 in Distributor Plugin
Summary
by MITRE • 10/16/2026
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The 10up Distributor plugin, prior to version 2.3.2, contains a critical missing authorization vulnerability within its ajax_push() function that fundamentally undermines the intended role-based access control mechanisms of WordPress multisite installations. This flaw specifically impacts users with Contributor-level permissions, who are typically restricted from publishing content directly and must submit posts for review by higher-privileged roles such as Editors or Administrators. The vulnerability arises because the plugin fails to verify whether the authenticated user has sufficient privileges on the target site before processing a push request intended to replicate content across the network. Consequently, an attacker with Contributor access can bypass these restrictions by exploiting the ajax_push() endpoint, which is designed for legitimate cross-site content distribution but lacks proper destination-specific permission checks.
The technical mechanism of this exploitation relies on the manipulation of nonce parameters and connection identifiers within HTTP POST requests directed at the plugin's AJAX handler. By crafting a request that includes a valid dt-push nonce alongside a chosen connection ID pointing to another site within the multisite network, an attacker can dictate the post status during the replication process. Specifically, the vulnerability allows the attacker to set the postStatus parameter to publish rather than draft or pending review. This capability effectively grants Contributor-level users the ability to bypass editorial workflows and directly publish content on remote sites where they hold no administrative or editing privileges. The absence of a secondary authorization check ensures that the system trusts the nonce alone, ignoring the user's actual permissions relative to the destination site in the network topology.
The operational impact of this vulnerability is significant for organizations relying on WordPress multisite environments for centralized content management and strict access control policies. Unauthorized publication of posts can lead to data integrity issues, reputational damage if malicious or inappropriate content appears on public-facing sites, and potential compliance violations depending on the nature of the organization. Furthermore, because Contributors are often internal staff members with limited privileges, this vulnerability represents a privilege escalation path that could be exploited by insiders seeking to gain undue influence over network-wide communications. The ability to publish directly without approval also circumvents audit trails and editorial oversight processes designed to maintain content quality and security standards across the distributed site structure.
To mitigate this risk, administrators of WordPress multisite networks using 10up Distributor must immediately upgrade to version 2.3.2 or later, where the authorization logic has been corrected to validate user permissions against the target site before allowing push operations. Until an update is applied, it is advisable to restrict access to the wp-admin-ajax.php endpoint for non-essential users and monitor logs for unusual POST requests targeting distributor-related actions. Additionally, implementing strict role definitions that minimize the number of Contributor accounts with network-wide visibility can reduce the attack surface. This vulnerability aligns with CWE-862, which describes missing authorization checks, and maps to MITRE ATT&CK technique T1078, involving valid account exploitation for unauthorized access within a system environment.