{"schema":"threatline.record/2","record":{"id":"CVE-2026-111628","aliases":["GHSA-wm53-9j85-ph6h"],"summary":"10up Distributor before 2.3.2 PHP Object Injection via set_meta()","details":"10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.","categories":["Unclassified"],"product":"Distributor","vendor":"10up","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111628","source_modified_at":"2026-10-23T18:34:49.579Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Distributor","vendor":"10up","versions":[{"version":"0","lessThan":"2.3.2","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111628","source_modified_at":"2026-10-23T18:34:49.579Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Distributor","ecosystem":null},"version":"2.3.2","basis":"first unaffected version stated in the CVE record"}],"cvss":2.3,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.0027,"percentile":0.18279,"score_date":"2026-10-23"},"published_at":"2026-10-16T17:39:02.847Z","modified_at":"2026-10-23T18:34:49.579Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111628","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T18:34:49.579Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111628","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/10up/distributor/security/advisories/GHSA-wm53-9j85-ph6h","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/10up/distributor/blob/2.3.1/includes/utils.php#L192-L200","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/10up/distributor/commit/7c57edb774d80534885ca6f2c46b95d333de6e5a","tags":["patch"]},{"source":"CVE List","url":"https://github.com/10up/distributor/releases/tag/2.3.2","tags":["release-notes"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/10up-distributor-before-2.3.2-php-object-injection-via-set-meta","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-23T18:34:35.579418Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T18:34:49.579Z","content_hash":"46dea3072a6d52ede7a0e4b3403a4c05a88515c0f216cf7e0e5990be3c97105c"}}