CVE-2026-109386

Name of the Vulnerable Software and Affected Versions The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress versions prior to 7.8.15

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with custom-level access and the hustle create capability can overwrite active Email Service Provider (ESP) integration credentials, such as API keys for AWeber, Constant Contact, Infusionsoft, ConvertKit, or HubSpot. This allows the attacker to divert lead submissions from Hustle forms to their own ESP tenant. Additionally, for HubSpot integrations, attackers can irreversibly delete the OAuth token, OAuth referer, and OAuth current-page option rows. The attack is facilitated by loading a Hustle module wizard page to obtain the hustle provider action nonce required to access the vulnerable handlers.

Recommendations Update the plugin to a version newer than 7.8.14.3.