EUVD-2026-74722
GHSA-rf7x-rwhg-53vc
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable via public form, no auth required, but AC:H for nesting bypass; impact limited to shortcode-dependent disclosure and limited integrity effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
AnalysisAI
Shortcode injection in the Hustle WordPress plugin (versions prior to 7.8.14.2) allows unauthenticated remote attackers to execute any shortcode registered on the target site by embedding nested shortcode syntax in form submission field values. The plugin substitutes submitted values into its post-submission success message, and while a guard exists to prevent shortcode execution, it can be defeated through shortcode nesting - causing WordPress to process and execute arbitrary registered shortcodes in the response. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Hustle WordPress plugin to be installed, active, and at a version prior to 7.8.14.2 on the target site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N yields a base score of 4.8 (Medium), with AC:H reflecting the nesting bypass complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Hustle WordPress plugin to version 7.8.14.2 or later via the WordPress plugin dashboard or the WPMU Dev Hub; this version contains the corrected shortcode sanitization guard that cannot be defeated by nesting. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting ma
The Hustle - Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Informatio
WPMU DEV Hustle plugin versions through 7.8.10.1 allow unauthenticated remote attackers to modify sensitive data via mis
The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high priv
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today