CVE-2026-80440

Deferred Deferred - Pending Action

Unauthenticated Shortcode Execution in Hustle WordPress Plugin

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: WPScan

Description

The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-80440

EUVD

EUVD-2026-74722

Affected Vendors & Products

Vendor	Product	Version / Range
the_hustle	wordpress_plugin	to 7.8.14.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

The Hustle WordPress plugin before version 7.8.14.2 has a flaw where user-submitted form values in success messages are not properly sanitized. Attackers can bypass security measures by nesting shortcodes, allowing unauthenticated execution of any registered shortcode on the site.

Detection Guidance

Check the installed version of The Hustle WordPress plugin. If it is below 7.8.14.2, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files in the /wp-content/plugins/the-hustle/ directory for version details.

Impact Analysis

This vulnerability allows unauthenticated attackers to run arbitrary shortcodes, which could lead to unauthorized actions, data leaks, or site defacement. It may also enable further exploitation if combined with other vulnerabilities.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized execution of shortcodes on a WordPress site. If exploited, it may enable attackers to access or manipulate sensitive data, which could violate data protection requirements under these regulations.

Mitigation Strategies

Update The Hustle plugin to version 7.8.14.2 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Monitor for suspicious activity or unauthorized shortcode executions.

Hi! I’m here to help you understand CVE-2026-80440. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70