The Hustle plugin includes an AJAX action named hustle_module_converted that records conversion events. A missing capability check allows anyone, even users who are not logged in, to trigger this action and create or modify conversion records. By sending crafted requests, an attacker can falsely inflate or deflate conversion counts for any module, including drafts that never reach visitors. This compromises data integrity, leading to inaccurate analytics and potentially misleading marketing decisions.

WordPress sites running the Hustle – Email Marketing, Lead Generation, Optins, Popups plugin from any version up to and including 7.8.10.2 are vulnerable. The issue is present in all editions of the plugin distributed via the WordPress plugin repository before the 7.8.11 release.

The vulnerability scores a CVSS of 5.3, indicating a medium severity. It does not appear in the CISA KEV catalog and no EPSS score is available. The attack can be carried out remotely by submitting HTTP requests to the plugin’s AJAX endpoint, so an unauthenticated actor can exploit it from any network with access to the site. While the impact is confined to analytics data, the ability to manipulate conversion statistics can erode business trust and lead to erroneous decisions.