CVE-2026-111631

Medium

Description

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection credentials to attacker-controlled servers, or abuse dt_begin_authorization to create connections.

SeverityMedium

CVSS5.4

Exploit probability—

Product

Distributor

PublishedOct 16, 2026

First seenOct 16, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

10up Distributor2.3.2 or later

Patches

github.com/10up/distributor/commit/71542b924fdd446a4183f32b928388d286ae5bb3

Vendor advisories

Affected products

Product	Affected versions	Fixed in
10up Distributor	v < 2.3.2	2.3.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.