CVE-2026-0911
Arbitrary File Upload in Hustle WordPress Plugin Enables RCE
Publication date: 2026-01-24
Last updated on: 2026-01-24
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| the_hustle | email_marketing_plugin | to 7.8.9.2 (inc) |
| unknown_vendor | wordpress-popup | 7.8.9.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Hustle WordPress plugin (up to version 7.8.9.2) and allows authenticated users with low privileges (such as Subscriber-level) to upload arbitrary files to the server due to improper file type validation in the action_import_module() function. Exploiting this requires an admin to grant module permissions or edit access to the low-privileged user, enabling them to access the Hustle admin page and obtain the necessary nonce. This arbitrary file upload can potentially lead to remote code execution on the affected server.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with low-level access to upload malicious files to your server, which may lead to remote code execution. This means the attacker could execute arbitrary code on your server, potentially compromising the entire website, stealing data, defacing the site, or using the server for further attacks.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the Hustle plugin for WordPress to version 7.8.9.3 or later, which includes fixes addressing the arbitrary file upload issue. Additionally, restrict or review permissions to ensure that low-privileged users do not have access to Hustle module permissions or module edit access, preventing them from exploiting the vulnerability. Applying the update that enhances nonce verification and fixes related security issues is critical. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking if the affected WordPress site is running the Hustle plugin version 7.8.9.2 or earlier and if low-privileged users have been granted Hustle module permissions or module edit access. Since the vulnerability allows arbitrary file uploads via the action_import_module() function, monitoring for unusual file upload activity on the Hustle admin page could help. However, no specific detection commands or network signatures are provided in the available resources. [2]