What is the CVSS score of CVE-2026-57736?

CVE-2026-57736 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of HubSpot WordPress Plugin are affected by CVE-2026-57736?

The HubSpot (Leadin) WordPress plugin (versions ≤11.3.51) contains a data exposure vulnerability allowing low-privileged authenticated users to retrieve embedded sensitive information transmitted by…

How to fix or mitigate CVE-2026-57736?

24 hours: Audit all WordPress installations for HubSpot plugin presence and version; disable plugin on production systems if alternative CRM integration exists. 7 days: If plugin cannot be removed, implement role-based access restrictions limiting plugin functionality to administrative accounts only; document current data protection controls. 30 days: Migrate to patched plugin version when released by vendor; if unavailable, deploy alternative CRM solution or implement network data loss prevention (DLP) controls on plugin traffic.

HubSpot WordPress Plugin CVE-2026-57736

EUVD-2026-41104 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-07-01 Patchstack

GHSA-j6hf-cv7p-rr4m

WordPress Information Disclosure Wordpress Plugin Hubspot

7.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.4 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

vuln.today AI

4.3 MEDIUM

Network-reachable but requires a low-privilege authenticated account (PR:L); pure CWE-201 disclosure yields limited confidentiality only, so I:N/A:N and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:21 vuln.today

DescriptionCVE.org

Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data.

This issue affects HubSpot: from n/a through 11.3.51.

AnalysisAI

Sensitive data exposure in the HubSpot (Leadin) WordPress plugin versions up to and including 11.3.51 allows a low-privileged authenticated user to retrieve embedded sensitive information that is inserted into data sent by the plugin. Reported by Patchstack and tracked as CWE-201 with a CVSS 7.4 (scope-changed), there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The realistic impact is limited to information disclosure of secrets or private data the plugin transmits, without evidence of widespread or automated exploitation.

Technical ContextAI

The affected component is the HubSpot marketing/CRM integration plugin for WordPress (formerly Leadin), which connects a WordPress site to HubSpot for forms, live chat, tracking, and lead capture. The weakness maps to CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin embeds sensitive values - such as API tokens, portal identifiers, internal configuration, or private CRM data - into responses or outbound data that a lower-privileged actor can observe. The single CPE provided (cpe:2.3:a:hubspot:hubspot:*) is a broad wildcard and does not itself pin the exact patched build; the version boundary 'through 11.3.51' comes from the Patchstack advisory rather than the CPE. The scope-changed CVSS flag (S:C) indicates the exposed data crosses a trust or authorization boundary beyond the vulnerable component itself.

RemediationAI

Update the HubSpot (Leadin) WordPress plugin to a release newer than 11.3.51; the input data confirms 11.3.51 as the last affected version but does not name an exact fixed version, so treat this as 'patch available per vendor advisory' and verify the specific patched build against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/leadin/vulnerability/wordpress-hubspot-plugin-11-3-51-sensitive-data-exposure-vulnerability?_s_id=cve) and the plugin changelog before deploying. If an update cannot be applied immediately, reduce exposure by tightening low-privilege account controls - review and minimize which roles/users hold authenticated access, disable open user self-registration, and audit any accounts at subscriber/contributor level - since exploitation requires an authenticated (PR:L) session; the trade-off is that restricting registration may disrupt legitimate membership or lead-capture workflows the plugin supports. Additionally, rotate any HubSpot API tokens or portal secrets that may have been embedded in transmitted data once patched.