Security hardening for subscription endpoints arrives in Distributor 2.3.1

Distributor 2.3.1 is a maintenance release focused on security. If your sites push or pull content between installs, this is one to apply promptly — it closes a vulnerability in the subscription endpoints that power Distributor’s automatic content updates, and it tightens the rules around who is allowed to create subscriptions in the first place.

What’s been fixed

The core of this release is a set of changes to how Distributor handles subscription requests, all reported through a coordinated security advisory. In short, Distributor now verifies that an incoming request is genuinely signed before acting on it, validates all incoming data before using it, and restricts taxonomy updates to those actually exposed through the REST API.

• Signature verification — Requests to the /receive endpoint are now checked for a valid subscription signature before anything is processed.
• Data validation — Incoming subscription data is validated up front, preventing PHP errors on the receiving site.
• Taxonomy scope — Subscription updates can only touch taxonomies that are visible in the REST API.
• Filter handling — The content_save_pre filter is now only removed during a post update and is restored immediately afterwards.

A change that may affect your setup

Requests to the subscription /create endpoint now require the edit_post capability. This is a deliberate tightening, but it can be a breaking change if you have deliberately allowed lower-privileged users or accounts to make Distributor requests. If your connections rely on a limited-permission user, check that the account still has the capability it needs before or immediately after updating.

Also in this release

Away from security, the Distributor icon on the post edit screen header was rendering far larger than intended, caused by a duplicate CSS class name clashing with list table styles. The styles have been renamed, which also resolves an interaction with Distributor’s Edit Remove Meta plugin.

For developers

The public method dt_verify_signature_authentication is deprecated in favour of verify_subscription_signature. If your custom code calls the old method directly, switch to the new one — the deprecated method remains for now but should not be relied on going forward. Also worth reviewing: any automation or integration that creates subscriptions programmatically will need to run as a user with the edit_post capability.

Thanks to new contributor @Banh-Bao-080899 for the security report, alongside @dkotter and @peterwilsoncc.

See the full release notes on GitHub. Learn more and download Distributor.