CVE-2026-109386 Details
Description
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.14.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to overwrite the site's active ESP integration credentials (AWeber, Constant Contact, Infusionsoft, ConvertKit, or HubSpot API keys) with attacker-controlled values — diverting all subsequent Hustle form lead submissions to the attacker's ESP tenant — and, for HubSpot, irreversibly delete the operator's OAuth token, OAuth referer, and OAuth current-page option rows. This requires the attacker to hold the plugin-granted hustle_create capability (e.g., an Editor delegated hustle_create but not hustle_edit_integrations via Hustle's Permissions tab), which allows them to load a Hustle module wizard page and obtain the hustle_provider_action nonce needed to reach the vulnerable handlers.
A vulnerability exists in the Hustle WordPress plugin, specifically in the Email Marketing, Lead Generation, Optins, Popups module, all versions through 7.8.14.3. The issue stems from an authorization bypass, where the plugin fails to properly verify if a user is authorized to perform certain actions. This flaw enables authenticated attackers with custom-level access to overwrite the site's active Email Service Provider (ESP) integration credentials for services like AWeber, Constant Contact, Infusionsoft, ConvertKit, or HubSpot with values controlled by the attacker. As a result, all subsequent lead submissions through Hustle forms are diverted to the attacker's ESP account. In the case of HubSpot, this exploitation also leads to the irreversible deletion of the operator's OAuth token and related option rows. To exploit this vulnerability, an attacker must have the hustle_create capability, allowing them to access Hustle's module wizard and obtain the necessary nonce to interact with the vulnerable AJAX handlers.
Users are advised to update the Hustle WordPress plugin to version 7.8.14.4 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 31, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hustle | <= 7.8.14.3 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2026 | New CVE Received | [email protected] |