CVE-2024-0368: Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0368?
CVE-2024-0368 is rated high due to its potential for exposing sensitive information, including personally identifiable information (PII).
How do I fix CVE-2024-0368?
To fix CVE-2024-0368, update the Hustle plugin to version 7.8.4 or later to remove the hardcoded API keys.
Who is affected by CVE-2024-0368?
All users of the Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress up to and including version 7.8.3 are affected by CVE-2024-0368.
What are the potential impacts of CVE-2024-0368?
The vulnerability allows unauthenticated attackers to extract sensitive data, leading to potential data breaches.
Is user authentication required to exploit CVE-2024-0368?
No, CVE-2024-0368 can be exploited by unauthenticated attackers, making it particularly dangerous.