Description
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the action_import_module() function in all versions up to, and including, 7.8.9.2. This makes it possible for authenticated attackers, with a lower-privileged role (e.g., Subscriber-level access and above), to upload arbitrary files on the affected site's server which may make remote code execution possible. Successful exploitation requires an admin to grant Hustle module permissions (or module edit access) to the low-privileged user so they can access the Hustle admin page and obtain the required nonce.
Published: 2026-01-24
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via Arbitrary File Upload
Action: Update Plugin
AI Analysis

Impact

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress allows authenticated users with Subscriber-level access or higher to upload files through the action_import_module() function in all versions up to 7.8.9.2. Incorrect file type validation permits any file type, which can be exploited to upload code that the server can execute, resulting in remote code execution on the host.

Affected Systems

This vulnerability affects installations of the Hustle plugin v7.8.9.2 and earlier, provided by wpmudev. The attack requires the plugin to be installed and activated on a WordPress site.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. EPSS is below 1%, so the likelihood of active exploitation is low, and the vulnerability is not currently listed in the CISA KEV catalog. An attacker must first attain the appropriate Hustle module permissions and an admin‑provided nonce to reach the upload functionality, but once achieved the impact can be significant.

Generated by OpenCVE AI on April 15, 2026 at 21:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Hustle plugin to the newest version available; the fix disables arbitrary file uploads and validates file types correctly.
  • If an immediate update is not possible, remove or deactivate the Hustle plugin to eliminate the vulnerable functionality.
  • Review the plugin’s module permission settings and restrict import or edit capabilities to administrators only, preventing low‑privileged users from accessing the upload endpoint.

Generated by OpenCVE AI on April 15, 2026 at 21:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Jan 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 26 Jan 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpmudev
Wpmudev hustle
Vendors & Products Wordpress
Wordpress wordpress
Wpmudev
Wpmudev hustle

Sat, 24 Jan 2026 12:45:00 +0000

Type Values Removed Values Added
Description The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the action_import_module() function in all versions up to, and including, 7.8.9.2. This makes it possible for authenticated attackers, with a lower-privileged role (e.g., Subscriber-level access and above), to upload arbitrary files on the affected site's server which may make remote code execution possible. Successful exploitation requires an admin to grant Hustle module permissions (or module edit access) to the low-privileged user so they can access the Hustle admin page and obtain the required nonce.
Title Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import
Weaknesses CWE-434
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Wordpress Wordpress
Wpmudev Hustle
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:41:45.913Z

Reserved: 2026-01-13T18:31:21.227Z

Link: CVE-2026-0911

cve-icon Vulnrichment

Updated: 2026-01-26T15:30:20.245Z

cve-icon NVD

Status : Deferred

Published: 2026-01-24T13:15:55.300

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-0911

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T21:45:14Z

Weaknesses