{"id":"CVE-2026-111628","kind":"vulnerability","aliases":["CVE-2026-111628"],"related":[],"title":"Distributor WordPress plugin: PHP object injection lets contributors instantiate objects","description":"10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.","summary":"Distributor, a WordPress plugin for sharing posts between sites, unserializes post meta twice, so a Contributor-level user can make the site create arbitrary PHP objects. Whether that leads to code execution depends on which gadget classes the site has loaded, which the sources do not say.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["distributor","package","wordpress","wp-plugin"],"not_affected_if":["distributor-2.3.2-or-later","no-contributor-accounts","plugin-not-installed"],"how_to_check":"- Check the installed Distributor version in the WordPress plugins screen or with `wp plugin get distributor --field=version`\n- Confirm the plugin is active on the destination site, where set_meta() in includes/utils.php runs","fix":"- Update Distributor to `2.3.2` or later","status":"open","published_at":"2026-10-16T18:17:42+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:31:01+00:00","updated_at":"2026-10-25T04:31:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:31:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update Distributor to `2.3.2` or later","reach":"internet","title":"Distributor WordPress plugin: PHP object injection lets contributors instantiate objects","impact":"medium","summary":"Distributor, a WordPress plugin for sharing posts between sites, unserializes post meta twice, so a Contributor-level user can make the site create arbitrary PHP objects. Whether that leads to code execution depends on which gadget classes the site has loaded, which the sources do not say.","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin","distributor"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker-defined PHP objects get created; code execution depends on gadget classes","analyst_note":"Check the NVD entry and the Distributor changelog to confirm whether gadget chains exist in WordPress core or common plugins, which sets the real impact.","how_to_check":"- Check the installed Distributor version in the WordPress plugins screen or with `wp plugin get distributor --field=version`\n- Confirm the plugin is active on the destination site, where set_meta() in includes/utils.php runs","needs_analyst":true,"not_affected_if":["plugin-not-installed","distributor-2.3.2-or-later","no-contributor-accounts"],"who_is_affected":"Sites running Distributor before `2.3.2` where Contributor-level accounts can create or edit distributed posts. Sites without Distributor, or where only Administrators and Editors can write content, are not exposed through this path. unknown whether the vendor advisory names other conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000627,"input_tokens":3350,"output_tokens":584,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111628':13A,16A '-2026':12A,15A '10up':71C '2.3.2':74C 'allow':82C 'arbitrari':47B 'attack':97C,118C 'attacker-defin':117C 'class':60B,127C 'code':54B 'contain':75C 'contributor':8A,39B,84C 'contributor-level':38B,83C 'creat':46B 'cve':11A,14A 'defin':119C 'depend':56B,123C 'destin':114C 'distribut':94C 'distributor':1A,17B,23B,72C 'doubl':92C 'execut':55B 'gadget':59B,126C 'impact':122C 'includes/utils.php':110C 'inject':6A,79C 'instanti':9A,88C 'lead':52B 'let':7A 'level':40B,85C 'load':64B,125C 'make':43B 'meta':34B,96C,105C,108C 'object':5A,10A,49B,78C,90C,120C 'packag':18B 'php':4A,48B,77C,89C,102C 'plugin':3A,22B,26B 'post':29B,33B,95C 'say':70B 'serial':101C 'set':107C 'share':28B 'site':31B,45B,62B,115C 'sourc':67B 'store':99C,116C 'string':103C 'twice':35B 'unseri':32B,93C,111C 'user':41B,86C 'vulner':80C 'whether':50B 'whose':121C 'wordpress':2A,19B,25B 'wp':21B 'wp-plugin':20B","nicknames":[],"mitigations":[],"who_affected":"Sites running Distributor before `2.3.2` where Contributor-level accounts can create or edit distributed posts. Sites without Distributor, or where only Administrators and Editors can write content, are not exposed through this path. unknown whether the vendor advisory names other conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111628","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111628","severity":null,"published_at":"2026-10-16T18:17:42+00:00","modified_at":"2026-10-23T19:17:42+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}