The vulnerability in 10up Distributor arises from the set_meta() function repeatedly unserializing post meta data. This flaw permits a Contributor‑level user to store a PHP serialized string as meta. When the destination site processes the meta, the string is unserialized twice, allowing the attacker to instantiate PHP objects of their choosing. Because the objects are created from untrusted data, the impact depends on the presence of gadget classes that can be exploited to achieve code execution or other malicious behavior. The weakness is classified as CWE‑502.

Vendors: 10up; Product: Distributor. Versions affected are all releases prior to 2.3.2, including 2.3.1 and earlier. The flaw can be exercised by any user who has Contributor privileges or higher and can set custom meta fields on posts. The impacted environment is the WordPress plugin ecosystem where the Distributor module is installed.

The CVSS base score is 2.3, indicating low overall severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting a limited risk of public exploitation. However, the attack vector is local to users with at least Contributor access: they can simply embed malicious serialized data into a meta field that is subsequently processed by the site. If gadget classes are present in the application or its dependencies, this can lead to remote code execution. The exploitation path therefore relies on an authenticated local user and on the existence of exploitable classes in the code base.