What is the CVSS score of CVE-2026-25431?

CVE-2026-25431 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WPMU DEV Hustle CVE-2026-25431

EUVD-2026-29536 MEDIUM

Missing Authorization (CWE-862)

2026-05-12 Patchstack

GHSA-q8j3-7hr2-pxhc

WordPress Authentication Bypass Hustle Wordpress Plugin Wpmu Dev

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 17:16 vuln.today

CVE Published

May 12, 2026 - 16:32 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in WPMU DEV Hustle allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Hustle: through 7.8.10.1.

AnalysisAI

WPMU DEV Hustle plugin versions through 7.8.10.1 allow unauthenticated remote attackers to modify sensitive data via missing authorization controls on access-restricted functionality. The vulnerability exploits incorrectly configured access control security levels, enabling attackers to bypass authentication mechanisms without user interaction. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

WPMU DEV Hustle is a WordPress plugin that provides popup and conversion-focused features. The vulnerability stems from improper implementation of authorization checks (CWE-862: Missing Authorization), where certain endpoints or functions that should enforce authentication and authorization do not properly validate user permissions before processing requests. This is a classic access control flaw common in WordPress plugin development where nonce validation or user capability checks are either missing or implemented inconsistently across administrative or user-facing AJAX handlers.

RemediationAI

Update WPMU DEV Hustle plugin to a version released after 7.8.10.1 - check the official WPMU DEV plugin repository or WordPress.org Hustle plugin page for the latest patched version number. Apply the update immediately through WordPress admin dashboard (Plugins > Installed Plugins > Hustle > Update) or manually via FTP/SFTP. If immediate patching is not possible, implement compensating controls by restricting access to Hustle admin pages via HTTP authentication or IP whitelisting at the web server level, and disable Hustle AJAX endpoints that do not require authentication using a security hardening plugin or custom code that validates user capabilities before processing requests. Verify the fix by checking the plugin version in WordPress admin and confirming that Hustle functionality still operates as expected post-update.