CVE-2026-109386
Received Received - Intake

Authorization Bypass in Hustle WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.14.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to overwrite the site's active ESP integration credentials (AWeber, Constant Contact, Infusionsoft, ConvertKit, or HubSpot API keys) with attacker-controlled values — diverting all subsequent Hustle form lead submissions to the attacker's ESP tenant — and, for HubSpot, irreversibly delete the operator's OAuth token, OAuth referer, and OAuth current-page option rows. This requires the attacker to hold the plugin-granted hustle_create capability (e.g., an Editor delegated hustle_create but not hustle_edit_integrations via Hustle's Permissions tab), which allows them to load a Hustle module wizard page and obtain the hustle_provider_action nonce needed to reach the vulnerable handlers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-109386
EUVD
EUVD-2026-114616

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Hustle WordPress plugin up to version 7.8.14.3 has an authorization bypass flaw. Authenticated attackers with custom-level access or higher can exploit this to change the plugin's email service provider (ESP) integration credentials without proper verification. This includes replacing API keys for services like AWeber or HubSpot, redirecting form submissions to attacker-controlled accounts, and for HubSpot, deleting OAuth tokens irreversibly.

Impact Analysis

If you use the Hustle plugin, an attacker could hijack your email marketing leads by diverting them to their own ESP account. This could lead to data theft, unauthorized access to customer information, or disruption of your email campaigns. For HubSpot users, the attack could also permanently break your OAuth integration.

Compliance Impact

This vulnerability could lead to unauthorized access or loss of control over user data collected via Hustle forms. If exploited, it may violate GDPR's data protection principles or HIPAA's security rules, depending on the data processed. Organizations could face compliance breaches, legal penalties, or reputational damage due to compromised data integrity.

Mitigation Strategies

Update the Hustle plugin to the latest version beyond 7.8.14.3 immediately. Disable the hustle_create capability for non-trusted users and review user roles with custom-level access or above. Check for unauthorized changes to ESP integration credentials and revoke any suspicious OAuth tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109386. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart