Threat database

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection credentials to attacker-controlled servers, or abuse dt_begin_authorization to create connections.

CVE-2026-111628 is a PHP object injection vulnerability in 10up Distributor versions before 2.3.2. It allows Contributor-level users to inject serialized PHP objects by double unserializing distributed post meta data. The vulnerability arises because the set_meta() function unserializes attacker-controlled serialized strings, potentially instantiating malicious objects. The impact depends on the presence of gadget classes loaded on the destination site. The CVSS score is low (2.3), reflecting limited impact and attack complexity.

10up Distributor versions prior to 2.3.2 have a missing authorization vulnerability in the ajax_push() function. This flaw allows Contributor-level multisite users to publish posts on other network sites without proper permissions by exploiting the dt-push nonce with a chosen connection ID and post status. The vulnerability enables unauthorized creation of draft or published posts on sites the attacker cannot normally access.

CVE-2026-110227 is a missing authorization vulnerability in the 10up Restricted Site Access plugin. It affects versions from initial releases up to 7.6.2. The flaw allows bypassing access control restrictions due to incorrectly configured security levels. The vulnerability has a medium severity with a CVSS score of 5.3, indicating limited impact on confidentiality and no impact on integrity or availability. No official patch or vendor advisory is provided in the data. No known exploits are reported in the wild.

Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.

Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4.

The Eight Day Week Print Workflow WordPress plugin up to version 1.2.6 contains a time-based blind SQL Injection vulnerability via the 'title' parameter in the pp-get-articles AJAX action. This vulnerability allows authenticated users with Subscriber-level access or higher to inject additional SQL queries due to insufficient input escaping and query preparation. The vulnerability can be exploited to extract sensitive database information. No official patch or remediation guidance is currently available from the vendor. The CVSS score is 6.5, indicating a medium severity risk.

Missing Authorization vulnerability in 10up Autoshare for Twitter autoshare-for-twitter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoshare for Twitter: from n/a through <= 2.3.1.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow allows Retrieve Embedded Sensitive Data.This issue affects Eight Day Week Print Workflow: from n/a through <= 1.2.5.

The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is due to missing capability checks on the 'azure-storage-media-replace' AJAX action. This makes it possible for authenticated attackers with subscriber-level access and above to delete arbitrary media files from the WordPress Media Library via the replace_attachment parameter granted they can access the nonce which is exposed to all authenticated users.

The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of data in version 2.8.4. This is due to a missing capability check on the migrate_from_wp_user_avatar() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to migrate avatar metadata for all users.

The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache function in all versions up to, and including, 2.7.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear user caches.

Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10.

Cross-Site Request Forgery (CSRF) vulnerability in 10up ElasticPress elasticpress.This issue affects ElasticPress: from n/a through <= 5.1.1.