CVE-2026-111628 in Distributor
Summary
by MITRE • 10/16/2026
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified within 10up Distributor versions prior to 2.3.2 represents a critical server-side request forgery and code execution risk rooted in improper handling of serialized data during cross-site content synchronization operations. This flaw specifically targets the mechanism by which post metadata is transferred from a source WordPress installation to a destination site via the distributor plugin's API endpoints. The core technical deficiency lies in the unvalidated deserialization process executed within the includes/utils.php file, where the set_meta function performs an unserialize operation on incoming data without sufficient integrity checks or type validation. This allows any user with Contributor-level permissions or higher to inject malicious PHP serialized strings into post meta fields on the source site, which are then automatically processed and instantiated as active objects when synchronized to the destination environment.
From a technical perspective, this vulnerability is classified under CWE-502, Deserialization of Untrusted Data, specifically involving insecure deserialization patterns where user-controlled input leads to object instantiation. The attack vector relies on the double unserialization behavior inherent in how certain WordPress meta fields are handled during distribution. When an attacker crafts a serialized PHP string containing specific gadget chains, they can exploit loaded classes within the destination environment's runtime context. These gadgets typically leverage common libraries or framework components present in modern WordPress installations to trigger arbitrary method calls, file system modifications, or remote code execution depending on the available class methods and their accessibility levels. The severity is amplified by the fact that Contributor-level access is relatively easy to obtain through social engineering or default installation configurations, lowering the barrier for exploitation significantly compared to vulnerabilities requiring Administrator privileges.
The operational impact of this vulnerability extends beyond simple data integrity compromise into full system takeover scenarios if successful gadget chains are available in the target environment. An attacker can manipulate application state by instantiating objects that interact with database layers, file systems, or external APIs. In worst-case scenarios, this leads to Remote Code Execution (RCE), allowing complete control over the web server hosting the WordPress instance. This aligns closely with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, particularly when PHP functions are invoked through instantiated objects. Furthermore, it relates to T1136, Create Account, if the attacker uses object injection to create new administrative users or modify existing permission structures via internal WordPress APIs exposed through these injected objects. The lack of input sanitization means that even seemingly benign metadata fields become vectors for complex exploitation chains involving reflection and dynamic method invocation.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to upgrade the 10up Distributor plugin to version 2.3.2 or later, where this deserialization flaw has been patched by implementing strict type checking and validating serialized data before instantiation. Organizations should also enforce least-privilege principles for user accounts, ensuring that Contributor-level users do not have unnecessary capabilities related to post meta manipulation unless absolutely required for their workflow. Additionally, deploying a Web Application Firewall (WAF) with rules designed to detect anomalous serialization patterns or known exploit signatures can provide an additional layer of defense against automated attacks targeting this specific vulnerability vector. Regular auditing of installed plugins and keeping all components updated is essential to minimize the attack surface associated with third-party code execution risks in WordPress ecosystems.