---
id: "CVE-2026-111628"
kind: "vulnerability"
aliases: ["CVE-2026-111628"]
title: "Distributor WordPress plugin: PHP object injection lets contributors instantiate objects"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["distributor", "package", "wordpress", "wp-plugin"]
not_affected_if: ["distributor-2.3.2-or-later", "no-contributor-accounts", "plugin-not-installed"]
published_at: "2026-10-16T18:17:42+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:31:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111628", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Distributor WordPress plugin: PHP object injection lets contributors instantiate objects

Distributor, a WordPress plugin for sharing posts between sites, unserializes post meta twice, so a Contributor-level user can make the site create arbitrary PHP objects. Whether that leads to code execution depends on which gadget classes the site has loaded, which the sources do not say.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Distributor version in the WordPress plugins screen or with `wp plugin get distributor --field=version`
- Confirm the plugin is active on the destination site, where set_meta() in includes/utils.php runs

## Fix

- Update Distributor to `2.3.2` or later

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111628

## From the sources

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_