PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111628 10up CVE debrief

A PHP object injection vulnerability exists in 10up Distributor before version 2.3.2. This vulnerability allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. The impact of this vulnerability depends on the loaded gadget classes. Defenders should assess exposure and prioritize verification of loaded gadget classes and their potential impact on the system, focusing on the set_meta() function in includes/utils.php where the unserialization occurs.

Vendor
10up
Product
Distributor
CVSS
LOW 2.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-16
Original CVE updated
2026-10-23
Advisory published
2026-10-16
Advisory updated
2026-10-23

Who should care

Defenders responsible for 10up Distributor installations should assess exposure and prioritize verification of loaded gadget classes and their potential impact on the system. This includes reviewing the current version of 10up Distributor, assessing the risk of PHP object injection, and prioritizing updates to version 2.3.2 or later. Security teams and vulnerability management teams should also be aware of the potential risks and plan accordingly.

Why it matters

This vulnerability allows Contributor-level users to instantiate PHP objects, potentially leading to security issues depending on the loaded gadget classes. Defenders should verify exposure and prioritize updates.

  • Verification of loaded gadget classes and their impact on the system is necessary.
  • Defenders should assess the risk of PHP object injection and prioritize updates to version 2.3.2 or later.

Technical summary

The vulnerability exists in the set_meta() function in includes/utils.php, which unserializes distributed post meta. This allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. The impact of this vulnerability depends on the loaded gadget classes. Defenders should prioritize verifying exposure and assessing the impact of loaded gadget classes on their systems, focusing on updates to version 2.3.2 or later for mitigation. The unserialization process can lead to security issues depending on the classes loaded in the environment.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of loaded gadget classes on their systems.

Recommended defensive actions

  • Verify exposure by checking if the installed version of 10up Distributor is prior to 2.3.2
  • Assess the impact of loaded gadget classes on the system
  • Update to version 2.3.2 or later
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the unserialization of attacker-defined objects in the set_meta() function in includes/utils.php. The impact of this vulnerability depends on the loaded gadget classes. Defenders should verify exposure by checking if the installed version of 10up Distributor is prior to 2.3.2 and assess the risk of PHP object injection. Verification of loaded gadget classes and their impact on the system is necessary.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111628 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111628

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111628 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111628

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • 10up Distributor before 2.3.2 PHP Object Injection via set_meta()

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111628.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/10up/distributor/security/advisories/GHSA-wm53-9j85-ph6h

    Supplemental source - vendor-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/10up/distributor/blob/2.3.1/includes/utils.php

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/10up/distributor/commit/7c57edb774d80534885ca6f2c46b95d333de6e5a

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/10up/distributor/releases/tag/2.3.2

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/10up-distributor-before-2.3.2-php-object-injection-via-set-meta

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.