The vulnerability is a missing authorization flaw in the WPMU DEV Hustle plugin, classified as CWE-862. It allows an attacker to bypass normal access controls and explore plugin features or modify plugin settings, potentially leading to unauthorized data exposure or manipulation. This form of broken access control can be leveraged to gain elevated privileges within the WordPress site without proper authentication, though the exact consequences have not been fully detailed in the advisory.

This issue impacts the WordPress Hustle plugin from any earlier version up to and including 7.8.14.2, as distributed by WPMU DEV. Users running any of these versions are affected and must address the vulnerability by upgrading or disabling the plugin.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, and there is no association with the CISA KEV catalog, suggesting no known active exploitation at this time. Based on the description, the likely attack vector is a web-based exploitation through the WordPress administrative interface where an authenticated user with insufficient permissions could exploit the broken access control. An attacker who can authenticate with a low-privilege account could potentially gain higher privileges or perform unauthorized actions within the plugin’s scope.