Distributor 2.3.2 is a security release, and the maintainers recommend updating immediately. This version resolves three separately reported security vulnerabilities. It adds no new features and makes no changes to how the plugin works day to day. If you use Distributor to share content between WordPress sites, install this update as soon as you can.
What’s fixed
The release addresses three security advisories. They were reported by first-time contributor @lichoin and fixed by the Distributor maintainers:
- GHSA-pxgv-j98h-3xhw — Resolved in this release.
- GHSA-26j8-r2m4-768c — Resolved in this release.
- GHSA-wm53-9j85-ph6h — Resolved in this release.
The release notes don’t describe the specific issues, which is common practice to give sites time to update before details become widely known. Because the fixes don’t change any features, you shouldn’t need to adjust your settings or workflows after upgrading.
For developers
Beyond the security fixes, this release includes several changes to the project’s development tooling. None of them affect the plugin’s public API, hooks or database.
- WordPress integration tests — A new test suite built on the WordPress PHPUnit test framework begins the move away from WP_Mock toward testing against a real WordPress environment.
- E2E test updates — The link/unlink end-to-end tests now use updated selectors to match recent markup changes to the block editor’s notice component.
- Node.js 22 — The repository now targets Node v22.
- Tooling upgrades —
@wordpress/envmoves to 11.15.0,@wordpress/scriptsto 35.0.0, and@10up/cypress-wp-utilsto 0.7.2. - Dependency bumps — The release updates
fast-uri,form-data,lodash,simple-git,systeminformationandtmpto their latest patched versions.