CVE-2026-111628: 10up Distributor before 2.3.2 PHP Object Injection via set_meta()
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which setmeta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs Contributor-level access and the ability to store serialized PHP data in post meta that will be distributed to a destination site.
Are destination sites at risk even if the attacker only has access to another site?
Yes. The vulnerable set_meta() handling occurs on the destination site when distributed post meta is processed, so a Contributor who can influence metadata on a source site may cause attacker-defined objects to be stored on the destination.
What determines the impact of successful exploitation?
The impact depends on the PHP gadget classes loaded on the destination site. The disclosed effects include potential confidentiality, integrity, and availability impact, but the available gadget chain determines what an instantiated object can do.
How can I determine whether an installation is affected?
Installations running 10up Distributor versions before 2.3.2 are affected. Review whether Contributors can create or modify distributed post metadata, particularly metadata containing serialized PHP strings.