Medium severity · published Nov 27, 2024
CVE-2024-10580
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized form submissions due to a missing capability check on the submit_form() function in all versions up to, and including, 7.8.5. This makes it possible for unauthenticated attackers to submit unpublished forms.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
Hustle – Email Marketing, Lead Generation, Optins, Popups · wpmudev
through 7.8.5 · source: vendor
HU
Hustle · Wpmudev
through 7.8.5 · source: CISA
Affected product
HE
Hustle – Email Marketing, Lead Generation, Optins, Popups
wpmudev
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10580
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10580
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.5/inc/front/hustle-module-front-ajax.php#L251
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3196639/wordpress-popup/tags/7.8.6/inc/front/hustle-module-front-ajax.php
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/3b2f8726-c4c4-4ed6-aa8d-4412cf5be061?source=cve
More from Hustle – Email Marketing, Lead Generation, Optins, Popups
8.6
CVE-2024-0368
Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys
7.5
CVE-2026-0911
Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import
6.4
CVE-2026-107710
Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
5.3
CVE-2026-2263
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation
4.9
CVE-2026-118169
Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter