CVE-2026-103075: WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Hustle pluginto a version that resolves this vulnerability.Fixed in 7.8.14.3
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs network access and low-level privileges. Exploitation is rated low complexity and does not require user interaction.
Which deployments should be prioritized for review?
Review WordPress sites running the WPMU DEV Hustle plugin at version 7.8.14.2 or earlier. Sites where low-privileged authenticated users can access plugin-related functionality are the most relevant exposure scenario.
What is the expected impact if exploitation succeeds?
The available severity data indicates low confidentiality impact, with no stated integrity or availability impact.