Medium severity · published Nov 26, 2024
CVE-2024-10579
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unpublished Form Exposure
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the preview_module() function in all versions up to, and including, 7.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view unpublished forms.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
Hustle – Email Marketing, Lead Generation, Optins, Popups · wpmudev
through 7.8.5 · source: vendor
Affected product
HE
Hustle – Email Marketing, Lead Generation, Optins, Popups
wpmudev
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10579
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10579
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.5/inc/hustle-modules-common-admin-ajax.php#L189
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wordpress-popup/trunk/inc/hustle-modules-common-admin-ajax.php#L189
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/ebd96d9c-c1ab-4a53-a52a-9fc2541482f2?source=cve
More from Hustle – Email Marketing, Lead Generation, Optins, Popups
8.6
CVE-2024-0368
Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys
7.5
CVE-2026-0911
Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import
6.4
CVE-2026-107710
Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
5.3
CVE-2026-2263
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation
5.3
CVE-2024-10580
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission