Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.3 - Authenticated (Custom-Access+) Missing Authorization to Integration Settings Modification and Provider Migration
- ID
- WPSEC-2026-1448
- Plugin
- Hustle – Email Marketing, Lead Generation, Optins, Popups (wordpress-popup)
- Affected
- all versions before 7.8.14.4
- Remediation
- Update to 7.8.14.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Hustle – Email Marketing, Lead Generation, Optins, Popups on WPSec AttackSurface
- Fix released
- Published
Description
The Hustle plugin for WordPress is vulnerable to unauthorized access and modification of data via several integration AJAX actions in all versions up to, and including, 7.8.14.3, due to missing capability checks in get_addons, get_form_addons, refresh_email_lists, form_settings, form_deactivate, insert_local_list, is_on_module and the migrate_* provider migration handlers. These handlers only verified a nonce, and that nonce is printed for any user who can open a Hustle module editor. This makes it possible for authenticated attackers who have been granted access to edit at least one Hustle module to change the integration settings of modules they are not allowed to edit, and to replace global provider API credentials through the migration handlers without the Integrations permission.
References
- https://wpsec.com/vuln/WPSEC-2026-1448/
- https://plugins.svn.wordpress.org/wordpress-popup/tags/7.8.14.4/
- https://wordpress.org/plugins/wordpress-popup/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS