CVE-2026-111625

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on site...

CVE-2026-111625 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on site...

CVE-2026-111625 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on site...

CVE-2026-111625

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on site...

EUVD-2026-103047

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on site...

CVE-2026-111625 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on site...

CVE-2026-111625

The 10up Distributor software (versions before 2.3.2 ) contains a missing authorization vulnerability within the ajax_push() function. This flaw allows Contributor-level multisite users to publish posts on other network sites to which they do not have access. By utilizing a dt-push nonce combined...

CVE-2026-111625: Missing Authorization

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on site...

10up Distributor authorization issue vulnerability

The 10up Distributor versions prior to 2.3.2 have an authorization issue vulnerability. This vulnerability stems from the lack of authorization verification in the ajaxpush function. It allows contributor-level multi-site users to use dt-push nonce along with the selected connection ID and...