CVE-2026-24998
Information Exposure in WPMU DEV Hustle Plugin
Publication date: 2026-02-03
Last updated on: 2026-02-03
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpmu_dev | hustle | to 7.8.9.2 (inc) |
| wpmu_dev | hustle | 7.8.9.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-497 | The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects the WordPress Hustle Plugin versions up to and including 7.8.9.2. To detect if your system is vulnerable, you should first verify the installed version of the Hustle plugin.
- Check the plugin version via the WordPress admin dashboard under Plugins.
- Alternatively, use WP-CLI to check the plugin version with the command: wp plugin list --format=json | grep hustle
- If the version is less than or equal to 7.8.9.2, your system is vulnerable.
Since the vulnerability allows unauthenticated access to sensitive data, monitoring HTTP requests for suspicious access patterns to Hustle plugin endpoints may help detect exploitation attempts, but specific detection commands or signatures are not provided.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-24998 involves exposure of sensitive system information to unauthorized parties, which falls under the OWASP Top 10 category A3: Sensitive Data Exposure.
Such exposure of sensitive data can potentially impact compliance with data protection regulations like GDPR and HIPAA, as these standards require protection of sensitive information from unauthorized access.
However, the provided information does not explicitly detail the direct effects on compliance with these standards or any specific regulatory implications.
Can you explain this vulnerability to me?
CVE-2026-24998 is a Sensitive Data Exposure vulnerability found in the WordPress Hustle Plugin versions up to and including 7.8.9.2.
This vulnerability allows unauthenticated attackers to access sensitive information that should normally be restricted.
It falls under the OWASP Top 10 category A3: Sensitive Data Exposure and has a CVSS score of 5.3, indicating a low severity impact.
The issue requires no privileges to exploit and was fixed in version 7.8.9.3.
How can this vulnerability impact me? :
This vulnerability can allow unauthorized attackers to retrieve sensitive system information from the affected WordPress Hustle Plugin.
Access to such sensitive data could potentially enable further exploitation of other system weaknesses.
Although the severity is considered low, the exposure of sensitive data can lead to privacy breaches or compromise of system integrity.
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'To mitigate the vulnerability in the WordPress Hustle Plugin, you should update the plugin to version 7.8.9.3 or later, as this version contains the fix for the sensitive data exposure issue.'}, {'type': 'paragraph', 'content': "Additionally, consider using Patchstack's mitigation services which include auto-updates for vulnerable plugins to help maintain security."}] [1]