CVE-2026-111628
Received Received - Intake

PHP Object Injection in 10up Distributor Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111628
EUVD
EUVD-2026-103050

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
10up Distributor 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a PHP object injection vulnerability in the 10up Distributor WordPress plugin before version 2.3.2. It allows Contributor-level users to inject malicious serialized PHP objects by double unserializing distributed post meta. The set_meta() function in includes/utils.php unserializes meta data on the destination site, enabling attackers to create attacker-defined objects if gadget classes are loaded.

Detection Guidance

Check if the Distributor WordPress plugin version is below 2.3.2. Inspect the includes/utils.php file for the set_meta function and verify if it performs double unserialization of meta values during push/pull operations.

Impact Analysis

The impact depends on loaded gadget classes but could include unauthorized data manipulation, cross-site scripting (XSS), or other security issues. Attackers with Contributor-level access can exploit this to push malicious meta data to destination sites during push/pull operations.

Mitigation Strategies

Update the Distributor plugin to version 2.3.2 or later. Review and sanitize meta data handling in the set_meta function to prevent double unserialization. Monitor for unauthorized changes or suspicious activity in post metadata.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111628. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart