Hustle CVE-2026-109386

Exploitation requires an authenticated WordPress account holding the plugin-granted hustle_create capability - specifically a role (e.g., Editor) that was delegated hustle_create but NOT hustle_edit_integrations through Hustle's Permissions tab; fully unauthenticated and ordinary low-privilege users cannot reach it. The attacker must first load a Hustle module wizard page to capture a valid hustle_provider_action nonce, which is the gate that lets the request reach the vulnerable provider handlers. The site must also have an active ESP integration configured (AWeber, Constant Contact, Infusionsoft, ConvertKit, or HubSpot) for the credential-overwrite and lead-diversion impact to matter; the irreversible OAuth-row deletion applies specifically to HubSpot. Limiting factors: the required delegated capability, the need to obtain the wizard-issued nonce, and the dependence on an already-configured ESP integration all constrain real-world exploitability below what a pure AV:N/UI:N score implies.

This is a genuine but bounded-priority issue rather than a drop-everything emergency. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, meaning network-reachable, low-complexity, no user interaction, but requiring an authenticated account (PR:L). The required privilege is not a trivial subscriber account: the attacker must hold the plugin-granted hustle_create capability (e.g., an Editor explicitly delegated hustle_create via Hustle's Permissions tab), which materially narrows the exploit population to semi-trusted internal users or compromised staff accounts. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The CVE is not listed in CISA KEV and there is no confirmed working exploit code - the vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-not-urgent remediation window. The references are Wordfence threat-intel plus WordPress.org trac source lines pinpointing the vulnerable handlers; these are code-location citations, not a packaged PoC. Signals are internally consistent: a low-to-medium severity authorization-bypass (CWE-862) in a popular plugin, no evidence of active exploitation, gated behind a specific delegated capability. One note for verification: the official vector sets C:N and A:N, but the described impacts - diverting all subsequent lead submissions to an attacker's ESP tenant and irreversibly deleting HubSpot OAuth option rows - arguably carry some confidentiality and availability impact, which my independent assessment reflects.

A WordPress site grants an Editor the Hustle hustle_create capability (to build opt-in forms) but withholds hustle_edit_integrations. That Editor - or an attacker who phishes/compromises such an account - opens a Hustle module wizard page to obtain a valid hustle_provider_action nonce, then issues an AJAX request to the provider admin handler to overwrite the site's active ESP API credentials (e.g., ConvertKit or HubSpot) with attacker-controlled values, silently redirecting every future form lead to the attacker's marketing tenant. No public working exploit code was identified at time of analysis; only source-line references to the vulnerable handlers are available.