{"id":"CVE-2026-111631","revision":"6c5fb1b9f3e34617b3ed43907b458854","records":[{"revision":"6c5fb1b9f3e34617b3ed43907b458854","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-111631","aliases":[],"title":"Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions","description":"Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection credentials to attacker-controlled servers, or abuse dt_begin_authorization to create connections.","state":0,"publishedAt":"2026-10-16T17:39:04.861+00:00","modifiedAt":"2026-10-16T21:19:10.473+00:00","affected":[{"ecosystem":"Vendor product","name":"Distributor","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"10up\",\n                    \"product\": \"Distributor\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.3.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:github/10up/distributor\",\n                    \"repo\": \"https://github.com/10up/distributor\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4,"severity":"MEDIUM"}],"references":["https://github.com/10up/distributor/security/advisories/GHSA-pxgv-j98h-3xhw","https://github.com/10up/distributor/blob/2.3.1/includes/external-connection-cpt.php#L231-L263","https://github.com/10up/distributor/blob/2.3.1/includes/external-connection-cpt.php#L716-L734","https://github.com/10up/distributor/commit/71542b924fdd446a4183f32b928388d286ae5bb3","https://github.com/10up/distributor/releases/tag/2.3.2","https://www.vulncheck.com/advisories/distributor-before-2.3.2-missing-authorization-in-external-connection-ajax-actions"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111631","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-111631","identifiers":["CVE-2026-111631"]},"retained":false,"historicalAffected":[]}],"coverage":[]}