GHSA-wm53-9j85-ph6h

Distributor: Double unserialization of meta allows authenticated users to push/pull objects

Distributor

Open in Threatline Record JSON

CVSS

n/aLow

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed in2.3.2Fixed versionGitHub

Published28 Sep 2026Updated 28 Sep 2026GitHub

What fixes it

2.3.2Distributor, wordpressGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Meta data is unserialized twice during the push and pulling of meta data. Once on the source site and once on the destination site.

This allows authenticated authors on one site to craft meta data to take advantage of this and cause objects to be stored in the meta data on the destination site.

The meta data can be created by anyone with the edit_posts capability (contributors+).

Workarounds

Upgrade to Distributor 2.3.2

References

GHSA-wm53-9j85-ph6h
https://github.com/10up/distributor/commit/7c57edb774d80534885ca6f2c46b95d333de6e5a
Version 2.3.2

Text from GitHub Advisory Database

Affected versions 1

Distributor, wordpress<=2.3.1GitHub