CVE-2026-80440: Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
WordPress sites using the Hustle plugin in a version earlier than 7.8.14.2 are affected. Exploitation depends on the site having one or more shortcodes registered that produce meaningful output or actions when executed.
Does an attacker need an account or user interaction to exploit it?
No. The issue is exploitable by an unauthenticated user through form submission, and it does not require victim interaction.
What makes exploitation possible?
The attacker must submit a crafted form value containing nested shortcode content that bypasses Hustle's shortcode guard. The vulnerable plugin then substitutes that value into its post-submission success message, where the shortcode can execute.