{"schema":"threatline.record/2","record":{"id":"GHSA-pxgv-j98h-3xhw","aliases":["GHSA-pxgv-j98h-3xhw"],"summary":"Insufficient permission checks for External Connection Post Type","details":"Reported by @lichoin\r\n\r\n## Summary\r\n\r\nThe editing and creation of external (REST API) connections in Distributor contain insufficient permission checks on the edit screen.\r\n\r\nThis allows users with the `edit_post` permission (Contributors +) to access the \"New External Connection\" screen to obtain the nonce required for the following AJAX actions:\r\n\r\n* `dt_verify_external_connection`\r\n* `dt_begin_authorization`\r\n\r\n## Cause\r\n\r\nThe issue is caused by a combination of errors with the registration and editing of the external connection CPT.\r\n\r\nThe creation and editing of the CPT is is intended to be limited to uses with the `manage_options` (this can be modified with the filter `dt_external_capabilities`). However the post type itself is registered using the default `post` capability in `Distributor\\ExternalConnectionCPT\\setup_cpt()`.\r\n\r\nWhile both `Distributor\\ExternalConnectionCPT\\ajax_verify_external_connection()` and `Distributor\\ExternalConnectionCPT\\ajax_begin_authorization()` include nonce checks via `check_ajax_referer()` they lack permission checks that the users have the permission to permissions to `manage_options`.\r\n\r\n## Impact\r\n\r\nAll users with the `edit_post` permission (Contributors +) can visit the \"Create New External Connection\" screen to obtain the nonce used for the AJAX endpoints above.\r\n\r\nWith this nonce they can craft AJAX requests to trigger the following.\r\n\r\n* leak authentication details to attacker controlled servers: using enumeration and well crafted AJAX requests users with `edit_post` can trigger requests containing authentication details to arbitrary web servers.\r\n* trigger the authentication process to attacker controlled servers: this can be used to cause the server to make requests to third party servers\r\n\r\n## Recommendations\r\n\r\nUpgrade to Distributor 2.3.2\r\n\r\n## References:\r\n\r\n* [GHSA-pxgv-j98h-3xhw](https://github.com/10up/distributor/security/advisories/GHSA-pxgv-j98h-3xhw)\r\n* https://github.com/10up/distributor/commit/71542b924fdd446a4183f32b928388d286ae5bb3\r\n* [Version 2.3.2](https://github.com/10up/distributor/releases/tag/2.3.2)","categories":["Unclassified"],"product":"Distributor","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/10up/distributor/security/advisories/GHSA-pxgv-j98h-3xhw","source_modified_at":"2026-09-28T22:20:57Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"ecosystem":"wordpress","name":"Distributor"},"range":"<=2.3.1"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/10up/distributor/security/advisories/GHSA-pxgv-j98h-3xhw","source_modified_at":"2026-09-28T22:20:57Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"ecosystem":"wordpress","name":"Distributor"},"version":"2.3.2"}],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-28T22:20:57Z","modified_at":"2026-09-28T22:20:57Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/10up/distributor/security/advisories/GHSA-pxgv-j98h-3xhw","fetched_at":"2026-10-28T01:10:53.534015Z","source_modified_at":"2026-09-28T22:20:57Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-28T22:20:57Z","content_hash":"a605ff8b3f027c77bc9ac9903006808ff5fc4a6e9737f00aeb2d1da596077020"}}