CVE-2026-111625

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.