MWB HubSpot CVE-2026-73396

Exploitation requires a valid WordPress subscriber-level account on the target site. This account is obtainable via self-registration if the WordPress installation has open user registration enabled (Settings > General > 'Anyone can register' checkbox), which is a common configuration on WooCommerce storefronts to support customer accounts. The target must be running MWB HubSpot for WooCommerce version 1.6.7 or earlier alongside an active WooCommerce installation. The PR:L CVSS metric confirms that fully unauthenticated exploitation is not possible - a subscriber session is the minimum barrier. Sites that disable open registration, use invitation-only account creation, or restrict subscriber role assignment significantly reduce exploitability, as obtaining a valid subscriber credential becomes the primary obstacle. The specific vulnerable endpoint or plugin feature has not been disclosed in available sources, which limits the ability to apply targeted endpoint-level blocking without vendor guidance.

The CVSS base score of 7.1 (High) is driven primarily by High availability impact (A:H) and network accessibility (AV:N) with low attack complexity (AC:L), though the practical severity is tempered by the PR:L requirement - subscriber-level access is a necessary precondition that blocks fully unauthenticated exploitation. No EPSS score was included in the available intelligence data, preventing probabilistic exploitation assessment. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified, indicating no confirmed active exploitation at time of analysis. The 'Information Disclosure' tag applied by Patchstack conflicts with the C:N CVSS metric; this discrepancy is unresolved in available sources and warrants review of the full advisory. Even a mid-sized municipal IT team in sopot managing WooCommerce storefronts should treat this as a priority patch action if subscriber-level registration is enabled, since that trivially-obtained account status collapses the privilege barrier. SSVC framing: exploitation status is none; the vector is automatable given low complexity and no user interaction; technical impact is partial - together suggesting medium-priority remediation, escalating to high if open registration is active.

An attacker self-registers as a subscriber on a WooCommerce store running MWB HubSpot for WooCommerce 1.6.7 or earlier, then authenticates and issues crafted HTTP requests targeting unguarded plugin AJAX or REST endpoints. Bypassing the intended authentication gate (CWE-288) with no additional complexity, the attacker disrupts HubSpot CRM synchronization or performs limited unauthorized data modifications. No public exploit code has been identified at time of analysis, but the low complexity and automatable nature of the attack vector mean tooling could be developed rapidly once technical details are disclosed.