The flaw sits in the ajax_push() handler of the 10up Distributor WordPress plugin, where an authorization check is missing when processing dt-push AJAX requests. As a result, any logged‑in user with a Contributor role can supply a valid nonce, a chosen connection id, and a postStatus value to create draft or published posts on network sites where they normally have no write permission. This bypass directly compromises site integrity by allowing unauthorized content publication, potentially enabling spam or malicious material to appear on sites that the user should not control.

All installations of the 10up Distributor plugin older than version 2.3.2 running on a WordPress multisite network, with any user assigned the Contributor role, are affected. The issue is tied specifically to the plugin’s pre‑2.3.2 releases, and only manifests when the multisite configuration allows the plugin to run across sites.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue, meaning no public exploits are currently documented. Exploitation requires an authenticated Contributor user and knowledge of a valid nonce and connection id, but once those prerequisites are met, the attacker can execute the attack via the exposed dt-push AJAX endpoint. While the attack vector is limited to the AJAX call, the potential impact is non‑trivial because it enables unauthorized content creation across the multisite network.