WPMU DEV Hustle CVE-2026-103075

Requires an authenticated WordPress session with at least a low-privileged role (PR:L) on a site running the Hustle plugin at or below version 7.8.14.2; exploitation does not require user interaction or elevated/admin privileges. The flaw is a missing authorization check (CWE-862), so the limiting factor is that an attacker must first hold any valid account on the target site - sites that do not allow user registration or that tightly control account creation substantially reduce exposure. Impact is confined to unauthorized read access (C:L) with no ability to modify data or disrupt availability. The exact feature/endpoint lacking the authorization check is not specified in the available data.

This is a low-to-moderate severity issue (CVSS 4.3) that should be patched routinely rather than treated as an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network-reachable, low-complexity exploitation but requires some authentication (PR:L), meaning an attacker needs at least a low-privileged WordPress account (e.g., subscriber/contributor). Impact is limited to a partial confidentiality breach (C:L) with no integrity or availability impact, consistent with a Missing Authorization (CWE-862) flaw exposing data or an action that should be access-controlled. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this reads as a real but low-urgency hygiene fix rather than a widespread-exploitation priority. Note a minor tag inconsistency: the input tags 'Authentication Bypass,' but the CWE-862 classification and Patchstack title ('Broken Access Control') describe missing authorization (an authenticated user accessing something above their permission level), not authentication bypass - these are distinct and the authorization framing should be trusted over the tag.

A user with a low-privileged WordPress account on a site running the Hustle plugin (≤7.8.14.2) sends a request to a plugin endpoint that fails to verify the caller's authorization level, retrieving data or performing an action restricted to higher-privileged roles. Because attack complexity is low and no user interaction is required, the request can be issued directly once the attacker holds any valid account. No public exploit code was identified at time of analysis.