CVE-2026-111628

Published 16 October 2026 · tracked since 17 October 2026

Description

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the de

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-111697 MEDIUM 6.5
• CVE-2026-111683 MEDIUM 5.4
• CVE-2026-111643 CRITICAL 9.8
• CVE-2026-111632 MEDIUM 5.4
• CVE-2026-111619 MEDIUM 6.5
• CVE-2026-111613 HIGH 7.5
• CVE-2026-111392 MEDIUM 4.8
• CVE-2026-109461 MEDIUM 5.9
• CVE-2026-97380 HIGH 8.8
• CVE-2026-86047 HIGH 7.7

→ Open the live CVE board · all tools