Live › vulnerability › CVE-2026-111628
Go to dashboardDistributor, a WordPress plugin for sharing posts between sites, unserializes post meta twice, so a Contributor-level user can make the site create arbitrary PHP objects. Whether that leads to code execution depends on which gadget classes the site has loaded, which the sources do not say.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Distributor before 2.3.2 where Contributor-level accounts can create or edit distributed posts. Sites without Distributor, or where only Administrators and Editors can write content, are not exposed through this path. unknown whether the vendor advisory names other conditions.
No product ranges from the sources yet.
wp plugin get distributor --field=version2.3.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.
This page as .md · .json · in your agent: get_signal("CVE-2026-111628")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.