The HubSpot All‑In‑One Marketing – Forms, Popups, Live Chat WordPress plugin allows attackers who are authenticated with Contributor or higher privileges to retrieve a list of all installed plugins and their versions. This missing authorization check can lead to sensitive information exposure, helping an attacker gather reconnaissance data for future attacks. The weakness is classified as CWE‑862.

Vendors: HubSpot dev. Product: HubSpot All‑In‑One Marketing – Forms, Popups, Live Chat. Affected versions are all releases up to and including 11.3.32, which are used on WordPress sites that have the plugin installed.

The vulnerability has a CVSS score of 4.3, indicating a moderate risk level, and an EPSS score of less than 1 percent, suggesting a low probability of current exploitation. It is not listed in the CISA KEV catalog. The attack requires authenticated access at the Contributor level, so only users who have been granted such permissions could exploit this weakness. Because the attacker can only read plugin information and not modify or execute code, the impact is limited to information disclosure and reconnaissance, not direct code execution or privilege escalation.