CVE-2026-111625Medium· 5.0▾ Sunlit10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connecti…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.
Distributor < 2.3.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111631Medium· 5.4Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions
CVE-2026-111628Medium· 5.010up Distributor before 2.3.2 PHP Object Injection via set_meta()
CVE-2026-110227Medium· 5.3Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2.
CVE-2025-12924Medium· 4.3A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224
CVE-2026-94077Medium· 6.5Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.
CVE-2026-94672Medium· 4.3Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.