CVE-2026-111625: 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A Contributor-level user in a WordPress multisite environment can exploit it. The attacker must be able to obtain and use a dt-push nonce, then supply a chosen connection ID and postStatus.
Are single-site WordPress deployments affected?
The described impact applies to multisite users publishing posts on other sites in the network. The provided information does not indicate an impact on single-site deployments.
What can an attacker do with successful exploitation?
An attacker can create posts as drafts or publish them on network sites they are not authorized to access. The stated impact is unauthorized modification of content, not disclosure of information or service disruption.
Which versions should be remediated?
Upgrade 10up Distributor to version 2.3.2 or later. Versions before 2.3.2 are identified as affected.