{"schema":"threatline.record/2","record":{"id":"GHSA-26j8-r2m4-768c","aliases":["GHSA-26j8-r2m4-768c"],"summary":"Authenticated access bypass pushing to network sites","details":"An insufficient permission check allows any user of a site to push a post to any other network site without being a member of the site.\r\n\r\nA user with the `edit_post` capability on one site can craft an AJAX request to the push endpoint with an arbitrary network ID to publish a post on a network site.\r\n\r\n## Cause\r\n\r\nThe `Distributor\\PushUI\\ajax_push` fails to check the `create_posts` or `publish_posts` capability for the user on the remote site, when pushing as a draft or published post respectively.\r\n\r\n## Impact\r\n\r\nUnauthorized creation of posts on network sites.\r\n\r\n## Recommendations\r\n\r\nUpgrade to Distributor 2.3.2\r\n\r\n## References:\r\n\r\n* [GHSA-26j8-r2m4-768c](https://github.com/10up/distributor/security/advisories/GHSA-26j8-r2m4-768c)\r\n* https://github.com/10up/distributor/commit/c80eaead0a686891045aed43e94fb38bdb9f218f\r\n* [Version 2.3.2](https://github.com/10up/distributor/commit/c80eaead0a686891045aed43e94fb38bdb9f218f)","categories":["Unclassified"],"product":"Distributor","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/10up/distributor/security/advisories/GHSA-26j8-r2m4-768c","source_modified_at":"2026-09-28T22:21:04Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"ecosystem":"wordpress","name":"Distributor"},"range":"<=2.3.1"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/10up/distributor/security/advisories/GHSA-26j8-r2m4-768c","source_modified_at":"2026-09-28T22:21:04Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"ecosystem":"wordpress","name":"Distributor"},"version":"2.3.2"}],"cvss":5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-28T22:21:04Z","modified_at":"2026-09-28T22:21:04Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/10up/distributor/security/advisories/GHSA-26j8-r2m4-768c","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-09-28T22:21:04Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-28T22:21:04Z","content_hash":"8fca16f0df29a8c9e3240a716e4b39fe3b8dd364f48a0be647d855cccecadba6"}}