What is the CVSS score of EUVD-2026-19988?

EUVD-2026-19988 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress EUVD-2026-19988

| CVE-2026-2263 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 security@wordfence.com

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 00:22 euvd

EUVD-2026-19988

Analysis Generated

Apr 08, 2026 - 00:22 vuln.today

CVE Published

Apr 08, 2026 - 00:16 nvd

MEDIUM 5.3

DescriptionCVE.org

The Hustle - Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hustle_module_converted' AJAX action in all versions up to, and including, 7.8.10.2. This makes it possible for unauthenticated attackers to forge conversion tracking events for any Hustle module, including draft modules that are never displayed to users, thereby manipulating marketing analytics and conversion statistics.

AnalysisAI

Unauthenticated attackers can forge conversion tracking events in The Hustle WordPress plugin (versions up to 7.8.10.2) by exploiting a missing capability check on the 'hustle_module_converted' AJAX action, allowing manipulation of marketing analytics and conversion statistics for any module including unpublished drafts. The vulnerability has a CVSS score of 5.3 (medium severity) with network-based attack vector and no authentication required, confirmed by Wordfence research with public code references available.

Technical ContextAI

The Hustle plugin handles email marketing and lead generation functionality in WordPress through AJAX endpoints. The vulnerable 'hustle_module_converted' AJAX action (located in hustle-module-front-ajax.php) processes conversion tracking data without verifying that the requesting user has appropriate WordPress capabilities (CWE-862: Missing Authorization). The plugin's front-end module system (hustle-module-front.php) invokes these AJAX handlers, which should validate user permissions before modifying conversion records. Because the capability check is entirely absent, any unauthenticated visitor can submit forged conversion events via direct AJAX requests, bypassing the normal flow that would restrict such operations to authenticated users with sufficient privileges.

RemediationAI

Update The Hustle plugin to version 7.8.11 or later, which includes a server-side capability check on the 'hustle_module_converted' AJAX action. Site administrators should navigate to WordPress Dashboard → Plugins → Installed Plugins and click 'Update Now' for The Hustle plugin. Wordfence provides detailed vulnerability tracking at https://www.wordfence.com/threat-intel/vulnerabilities/id/2305462c-0a00-4423-8dc2-e32628c4864d. No workaround is available prior to upgrading; sites running vulnerable versions should prioritize this update as the exploitation method requires no authentication and is easily automatable.