These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-111631 is a missing authorization vulnerability in Distributor before version 2.3.2. This vulnerability allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can exploit this to send stored connection credentials to attacker-controlled servers or create connections. Site administrators and security teams should assess their exposure [truncated]
A PHP object injection vulnerability exists in 10up Distributor before version 2.3.2. This vulnerability allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. The impact of this vulnerability depends on the loaded gadget classes. Defenders should assess exposure and prioritize verification of loaded gadget classes and their potential impact on the system, [truncated]
The 10up Distributor plugin before version 2.3.2 contains a missing authorization vulnerability in the ajax_push() function, allowing Contributor-level multisite users to create draft or published posts on other network sites they cannot access. This medium-severity vulnerability, with a CVSS score of 5.3, requires attention from multisite network administrators and security teams to prevent potential una [truncated]
The CVE-2026-110227 vulnerability affects the WordPress Restricted Site Access plugin, versions up to and including 7.6.2. This issue is a Missing Authorization vulnerability, which could allow attackers to exploit incorrectly configured access control security levels. The CVSS score for this vulnerability is 5.3, indicating a medium severity level.
CVE-2026-62088 debrief based on the supplied source corpus. The ElasticPress plugin is vulnerable to Insertion of Sensitive Information Into Sent Data, allowing Retrieve Embedded Sensitive Data. This issue affects ElasticPress from n/a through 5.3.4. Defenders should assess exposure and prioritize verification of plugin versions to prevent sensitive data exposure. The CVE record and NVD entry provide limi [truncated]