CVE-2026-2263
Unauthorized Data Modification in Hustle WordPress Plugin via Missing Capability Check
Publication date: 2026-04-08
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpbeaverbuilder | hustle | to 7.8.10.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated attackers to forge conversion tracking events and manipulate marketing analytics and conversion statistics by exploiting a missing capability check in the Hustle WordPress plugin.
However, there is no information provided in the available context or resources about how this vulnerability specifically impacts compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
The vulnerability exists in the Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress, specifically in all versions up to and including 7.8.10.2.
It is caused by a missing capability check on the 'hustle_module_converted' AJAX action, which allows unauthenticated attackers to modify data without authorization.
This enables attackers to forge conversion tracking events for any Hustle module, including draft modules that are never shown to users, thereby manipulating marketing analytics and conversion statistics.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to manipulate your marketing analytics and conversion statistics.
Since attackers can forge conversion tracking events, the data you rely on for marketing decisions could be inaccurate or misleading.
This could lead to poor business decisions based on falsified data and potentially damage your marketing effectiveness.