Description
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
10up Distributor
Default version status: unaffected
0 to < 2.3.2affected
pkg:github/10up/distributorReferences
- https://github.com/10up/distributor/security/advisories/GHSA-26j8-r2m4-768c ↗
- https://github.com/10up/distributor/blob/2.3.1/includes/push-ui.php#L252-L357 ↗
- https://github.com/10up/distributor/commit/c80eaead0a686891045aed43e94fb38bdb9f218f ↗
- https://github.com/10up/distributor/releases/tag/2.3.2 ↗
- https://www.vulncheck.com/advisories/10up-distributor-before-2.3.2-missing-authorization-via-dt-push-ajax-action ↗