All vulnerabilities
GHSA-26j8-r2m4-768c

Distributor: Authenticated access bypass pushing to network sites

Distributor
Open in ThreatlineRecord JSON
CVSS
5.0Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2.3.2Fixed versionGitHub
Published28 Sep 2026Updated 28 Sep 2026GitHub

What fixes it

  • 2.3.2Distributor, wordpressGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An insufficient permission check allows any user of a site to push a post to any other network site without being a member of the site.

A user with the edit_post capability on one site can craft an AJAX request to the push endpoint with an arbitrary network ID to publish a post on a network site.

Cause

The Distributor\PushUI\ajax_push fails to check the create_posts or publish_posts capability for the user on the remote site, when pushing as a draft or published post respectively.

Impact

Unauthorized creation of posts on network sites.

Recommendations

Upgrade to Distributor 2.3.2

References:

Text from GitHub Advisory Database

Affected versions 1

  • Distributor, wordpress<=2.3.1GitHub