This vulnerability in the 10up Distributor plugin before version 2.3.2 allows users with Contributor privileges to call back‑end AJAX actions that are intended for administrators with the manage_options capability. By invoking dt_verify_external_connection with a chosen endpointId and URL, a contributor can send stored connection credentials to an attacker‑controlled server. In addition, abusing dt_begin_authorization may let the contributor fabricate new connections, effectively giving the attacker control over the plugin’s external connectivity.

All installations of the 10up Distributor WordPress plugin running any version prior to 2.3.2 are affected. The flaw resides in the external-connection-cpt.php code, which does not check for the required manage_options capability on the AJAX endpoints.

The vulnerability carries a mid‑level CVSS score of 5.3 and is not listed in the CISA KEV catalog. Because the flaw is accessed through normal WordPress AJAX requests, any authenticated Contributor can exploit it without additional conditions. External attackers who have gained Contributor access or canvassed credentials through other means face a realistic risk of credential theft or unauthorized connection creation, especially in sites where the plugin is enabled and external connections are used.