Live › vulnerability › CVE-2026-111625
Go to dashboardDistributor, a WordPress plugin for pushing posts between sites, has a missing authorization check in its ajax_push() handler before version 2.3.2. A Contributor-level user on a WordPress multisite network can create draft or published posts on other network sites they cannot access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only WordPress multisite networks that run the Distributor plugin before 2.3.2 and have Contributor-level users are exposed. Single-site installs and networks without Distributor can skip this.
No product ranges from the sources yet.
wp plugin get distributor --field=version, and confirm whether the site runs as a multisite network.2.3.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.
This page as .md · .json · in your agent: get_signal("CVE-2026-111625")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.