Description
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
Published: 2026-09-09
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

The Hustle WordPress plugin before 7.8.14.2 allows unauthenticated users to submit form values that contain WordPress shortcodes. When the plugin substitutes these values into its success message, the guard that is intended to neutralize shortcodes can be bypassed by nesting, so the shortcodes are executed by WordPress. This flaw corresponds to CWE‑74, Improper Neutralization of Input During Web Page Generation, and it enables an attacker to run any shortcode registered on the site, potentially leading to remote code execution within the WordPress context limited to the capabilities of those shortcodes.

Affected Systems

WordPress sites that use the Hustle plugin with a version older than 7.8.14.2 are affected. No further version constraints are specified beyond this cutoff.

Risk and Exploitability

The CVSS score of 4.8 indicates low‑to‑moderate impact, and the EPSS score of less than 1% reflects a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers exploit the flaw by submitting an unauthenticated form that contains a crafted shortcode, which is then evaluated in the success message rendering path.

Generated by OpenCVE AI on September 9, 2026 at 21:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Hustle plugin to version 7.8.14.2 or later.
  • If the plugin offers an option to disable shortcode execution in success messages, enable that setting.
  • Restrict form submissions to authenticated users or apply access controls to prevent unauthenticated submissions.

Generated by OpenCVE AI on September 9, 2026 at 21:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-94

Wed, 09 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-74
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 09 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-94

Wed, 09 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Description The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
Title Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-09-09T15:23:25.033Z

Reserved: 2026-08-26T11:10:10.203Z

Link: CVE-2026-80440

cve-icon Vulnrichment

Updated: 2026-09-09T15:21:51.418Z

cve-icon NVD

Status : Deferred

Published: 2026-09-09T07:16:58.427

Modified: 2026-09-09T16:17:09.797

Link: CVE-2026-80440

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T21:30:15Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')