Is CVE-2026-111631 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111631 being exploited in the wild.

How severe is CVE-2026-111631?

Medium severity, with a CVSS score of 5.4, published 16 October 2026.

Is there a fix for CVE-2026-111631?

Yes: fixed in 2.3.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111631 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111631?

Check whether you run 10up Distributor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111631: Distributor authorization bypass in external connection AJAX

CVE-2026-111631 · Severity: medium · CVSS 5.4 · Published 2026-10-16

Distributor is a WordPress plugin that manages content distribution across multiple sites. The plugin fails to properly check user permissions on certain administrative functions, allowing lower-privilege users to steal stored connection credentials by sending them to attacker-controlled servers, or to create unauthorized connections.

Technologies: 10up Distributor. Vendors: 10up.

Quick answers

Is CVE-2026-111631 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111631 being exploited in the wild.
How severe is CVE-2026-111631?: Medium severity, with a CVSS score of 5.4, published 16 October 2026.
Which products and versions are affected?: 10up Distributor before 2.3.2.
Is there a fix for CVE-2026-111631?: Yes: fixed in 2.3.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111631 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111631?: Check whether you run 10up Distributor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.3.2

Technical details

A missing authorization check in the AJAX handlers dt_verify_external_connection and dt_begin_authorization allows Contributor-level users to invoke actions restricted to manage_options administrators. An unauthenticated attacker with Contributor access can call these functions with arbitrary endpointId and url parameters to exfiltrate stored connection credentials or create unauthorized external connections.

Affected products

10up Distributor before 2.3.2

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.