What is the CVSS score of CVE-2026-9656?

CVE-2026-9656 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

HubSpot Marketing Plugin CVE-2026-9656

EUVD-2026-45152 MEDIUM

Information Exposure (CWE-200)

2026-07-17 Wordfence

GHSA-3rq5-wph4-p3mg

WordPress Information Disclosure Wordpress Plugin Hubspot All In One Marketing Forms Popups Live Chat

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

9.6 CRITICAL

Stolen OAuth token grants full read/write on the external HubSpot tenant (S:C), raising confidentiality and integrity impact beyond the WordPress installation alone.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 07:46 vuln.today

CVE Published

Jul 17, 2026 - 06:53 cve.org

MEDIUM 4.3

DescriptionCVE.org

The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.62 via the wp_localize_script() / window.leadinConfig JavaScript object. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the site's plaintext HubSpot OAuth refresh token exposed via the window.leadinConfig JavaScript object, which can then be used to access or modify data in the connected HubSpot tenant. Although the refresh token is stored at rest with AES-256-CTR encryption, decryption occurs server-side before the plaintext value is passed to wp_localize_script(), rendering the at-rest encryption ineffective against this exposure path.

AnalysisAI

OAuth refresh token theft in HubSpot All-In-One Marketing - Forms, Popups, Live Chat (WordPress plugin 'leadin') exposes connected HubSpot tenants to unauthorized access. Authenticated WordPress users at contributor level or above can extract a plaintext HubSpot OAuth refresh token directly from the client-side window.leadinConfig JavaScript object, which is populated server-side via wp_localize_script() after the plugin decrypts the at-rest AES-256-CTR-encrypted token - rendering the encryption entirely ineffective against this attack path. A stolen token can be replayed against the HubSpot OAuth API to access or modify CRM contacts, marketing campaigns, and other tenant data in the connected HubSpot account. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.

Technical ContextAI

The affected software is the WordPress plugin 'leadin' by hubspotdev, identified via CPE cpe:2.3:a:hubspotdev:hubspot_all-in-one_marketing_-_forms,_popups,_live_chat:*:*:*:*:*:*:*:*. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), arising from WordPress's wp_localize_script() mechanism, which serializes PHP server-side data into a globally accessible JavaScript object (window.leadinConfig) rendered inline on page load. The plugin stores the HubSpot OAuth refresh token in the WordPress database encrypted with AES-256-CTR; however, decryption occurs in PHP before the plaintext value is passed to wp_localize_script(), making the encryption protection irrelevant to this exposure path. Affected code paths are visible in plugin source files class-adminconstants.php (line 190), class-oauth.php (line 46), class-gutenberg.php (line 44), and class-assetsmanager.php (line 150) at plugin version 11.3.45, establishing the long-standing nature of this pattern. The OAuth refresh token, once obtained, allows persistent programmatic access to the connected HubSpot tenant independent of WordPress.

RemediationAI

Update the HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin to version 11.3.64 or later, the patched version indicated by the plugin repository changeset (https://plugins.trac.wordpress.org/changeset?old_path=%2Fleadin/tags/11.3.62&new_path=%2Fleadin/tags/11.3.64). After applying the patch, administrators should immediately rotate the HubSpot OAuth refresh token via the HubSpot developer portal to invalidate any tokens that may have already been exposed - failure to rotate leaves previously stolen tokens viable even after patching. As an interim compensating control prior to patching, restrict contributor-level and above WordPress roles to the smallest possible set of trusted users; note this has operational impact on editorial workflows. Temporarily deactivating the plugin eliminates the exposure surface entirely but also disables all HubSpot form, popup, and live chat functionality. Generic network-layer controls (WAF, IP allowlisting) cannot mitigate this vulnerability, as the token is exposed to any authenticated browser session, not a specific malformed request.