CVE-2026-111628 — 10up Distributor before 2.3.2 PHP Object Injection via set_meta()
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed po…
Published: 2026-10-16 · CVSS: 2.3 · CVSS 4.0
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.
Source: CVE Program · Revision f6a1ec2617c75ab2904c463b0d44504dff84e042