CVE-2026-111628

Name of the Vulnerable Software and Affected Versions 10up Distributor versions prior to 2.3.2

Description Contributor-level users can instantiate PHP objects through double unserialization of distributed post meta. An attacker can store a serialized PHP string as meta, which is then processed by the set meta() function in includes/utils.php on the destination site. This allows the storage of attacker-defined objects, with the final impact determined by the available gadget classes (sets of existing code fragments that can be chained together to execute unintended actions).

Recommendations Update to version 2.3.2 or later. As a temporary mitigation, restrict the use of the set meta() function in includes/utils.php.