The WPMU DEV Hustle plugin through version 7.8.9.2 contains a flaw that enables any attacker, regardless of authentication, to retrieve embedded sensitive data. The vulnerability is classified as an exposure of sensitive system information to an unauthorized control sphere, allowing malicious actors to view data that should be restricted to site administrators. The primary impact is the unauthorized disclosure of confidential information, which can lead to compromise of site security and user privacy.

WordPress sites that have the Hustle popup plugin installed from the earliest available build up to version 7.8.9.2 are affected. The issue does not appear to be limited to particular WordPress themes or server configurations and applies to any site that uses the specified plugin versions.

The CVSS score of 5.3 indicates a medium severity flaw, and the EPSS score of less than 1% shows a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting that there are no known active attacks. However, the flaw can be exploited remotely through the plugin’s exposed endpoints, and the lack of authentication checks directly increases the risk of sensitive data leakage.