Live › vulnerability › CVE-2026-111631
Go to dashboardDistributor, a WordPress plugin, has a missing authorization check that lets Contributor-level users call AJAX actions meant only for administrators. An attacker can send stored external connection credentials to a server they control, or create new connections.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Distributor before 2.3.2 that have Contributor accounts, including accounts that can be created by open registration or by a compromised author account. Sites with no Contributor-level users can rate the exposure lower, but the sources do not say whether other roles are also reachable.
No product ranges from the sources yet.
wp plugin get distributor --field=version2.3.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection credentials to attacker-controlled servers, or abuse dt_begin_authorization to create connections.
This page as .md · .json · in your agent: get_signal("CVE-2026-111631")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.