PT-2026-116024

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax push that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sit...