CVE-2026-111625

Name of the Vulnerable Software and Affected Versions 10up Distributor versions prior to 2.3.2

Description A missing authorization issue exists in the ajax push() function. This allows users with Contributor-level permissions in a multisite environment to publish posts on other sites within the network. An attacker can exploit this by using the dt-push nonce along with a selected connection id and postStatus to create draft or published posts on sites they are not authorized to access.

Recommendations Update to version 2.3.2 or later. As a temporary mitigation, restrict the use of the ajax push() function for users with Contributor-level permissions.