CVE-2024-0368
First published: Wed Mar 13 2024(Updated: )
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hustle | <7.8.4 | |
| Hustle | <=7.8.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api
- https://developers.hubspot.com/docs/api/webhooks#scopes
- https://plugins.trac.wordpress.org/browser/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php#L13
- https://plugins.trac.wordpress.org/changeset/3047775/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php?old=3025070&old_path=wordpress-popup/tags/7.8.3/inc/providers/hubspot/hustle-hubspot-api.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d40b41-540d-476d-afde-970845543933?source=cve
Frequently Asked Questions
What is the severity of CVE-2024-0368?
CVE-2024-0368 is rated high due to its potential for exposing sensitive information, including personally identifiable information (PII).
How do I fix CVE-2024-0368?
To fix CVE-2024-0368, update the Hustle plugin to version 7.8.4 or later to remove the hardcoded API keys.
Who is affected by CVE-2024-0368?
All users of the Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress up to and including version 7.8.3 are affected by CVE-2024-0368.
What are the potential impacts of CVE-2024-0368?
The vulnerability allows unauthenticated attackers to extract sensitive data, leading to potential data breaches.
Is user authentication required to exploit CVE-2024-0368?
No, CVE-2024-0368 can be exploited by unauthenticated attackers, making it particularly dangerous.
- agent/references
- agent/author
- agent/description
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/first-publish-date
- agent/source
- agent/remedy
- agent/last-modified-date
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- vendor/wpmudev
- canonical/hustle
- vendor/the hustle