{"schema":"threatline.record/2","record":{"id":"GHSA-wm53-9j85-ph6h","aliases":["GHSA-wm53-9j85-ph6h"],"summary":"Double unserialization of meta allows authenticated users to push/pull objects","details":"### Impact\r\n\r\nMeta data is unserialized twice during the push and pulling of meta data. Once on the source site and once on the destination site.\r\n\r\nThis allows authenticated authors on one site to craft meta data to take advantage of this and cause objects to be stored in the meta data on the destination site.\r\n\r\nThe meta data can be created by anyone with the `edit_posts` capability (contributors+).\r\n\r\n### Workarounds\r\n\r\nUpgrade to Distributor 2.3.2\r\n\r\n### References\r\n\r\n* [GHSA-wm53-9j85-ph6h](https://github.com/10up/distributor/security/advisories/GHSA-wm53-9j85-ph6h)\r\n* https://github.com/10up/distributor/commit/7c57edb774d80534885ca6f2c46b95d333de6e5a\r\n* [Version 2.3.2](https://github.com/10up/distributor/releases/tag/2.3.2)\r\n\r\n","categories":["Unclassified"],"product":"Distributor","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/10up/distributor/security/advisories/GHSA-wm53-9j85-ph6h","source_modified_at":"2026-09-28T22:21:11Z","fetched_at":"2026-10-24T14:26:37.433577Z","package":{"ecosystem":"wordpress","name":"Distributor"},"range":"<=2.3.1"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/10up/distributor/security/advisories/GHSA-wm53-9j85-ph6h","source_modified_at":"2026-09-28T22:21:11Z","fetched_at":"2026-10-24T14:26:37.433577Z","package":{"ecosystem":"wordpress","name":"Distributor"},"version":"2.3.2"}],"cvss":null,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-28T22:21:11Z","modified_at":"2026-09-28T22:21:11Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/10up/distributor/security/advisories/GHSA-wm53-9j85-ph6h","fetched_at":"2026-10-24T14:26:37.433577Z","source_modified_at":"2026-09-28T22:21:11Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-28T22:21:11Z","content_hash":"a97b7d8c2893dc3302aff00bb5fb7e25bed03e98f26820d25197fdcee8d8884f"}}