CVE-2026-0911: Hustle WordPress Plugin RCE Vulnerability

CVE-2026-0911 Overview

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress contains an arbitrary file upload vulnerability due to incorrect file type validation in the action_import_module() function. This security flaw affects all versions up to and including 7.8.9.2, allowing authenticated attackers with low-privileged roles (Subscriber-level access and above) to upload arbitrary files on the affected site's server.

Critical Impact

Successful exploitation of this vulnerability may enable remote code execution on the affected WordPress site. An attacker who can upload malicious files (such as PHP web shells) could gain complete control over the web server, potentially leading to data theft, website defacement, or use of the compromised server for further attacks.

Affected Products

• Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress versions up to and including 7.8.9.2

Discovery Timeline

• 2026-01-24 - CVE CVE-2026-0911 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-0911

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw exists in the action_import_module() function which fails to properly validate file types during the module import process. The network-based attack requires authentication with at least Subscriber-level privileges, making it accessible to low-privileged users who have been granted specific Hustle module permissions.

The exploitation scenario requires an administrative user to first grant Hustle module permissions (or module edit access) to a low-privileged user. Once granted, the attacker can access the Hustle admin page to obtain the required nonce for the upload request. This prerequisite introduces complexity to the attack chain but does not eliminate the risk, particularly in environments where module permissions may be loosely configured or where privilege escalation has already occurred.

Root Cause

The root cause lies in the improper implementation of file type validation within the action_import_module() function. Instead of employing a strict allowlist of permitted file extensions and MIME types, the function relies on insufficient validation mechanisms that can be bypassed. This allows attackers to upload files with executable extensions (such as .php) that should otherwise be rejected during the import process.

Attack Vector

The attack is conducted over the network and requires authentication. An attacker with Subscriber-level or higher privileges who has been granted Hustle module permissions can:

1. Access the Hustle admin page within the WordPress dashboard
2. Obtain the required security nonce from the page
3. Craft a malicious file upload request to the action_import_module() endpoint
4. Upload an arbitrary file (such as a PHP web shell) to the server
5. Access the uploaded file to execute arbitrary code on the server

The vulnerability mechanism exploits the insufficient file type validation in the module import functionality. When a user with appropriate permissions submits a file through the import interface, the action_import_module() function processes the upload without adequately verifying that the file content and extension match expected safe formats. For detailed technical analysis, refer to the Wordfence Vulnerability Report and the WordPress Plugin Change Log.

Detection Methods for CVE-2026-0911

Indicators of Compromise

• Unexpected files with executable extensions (.php, .phtml, .php5) appearing in WordPress upload directories or plugin folders
• HTTP POST requests to Hustle plugin endpoints containing file upload payloads with suspicious content types
• New or modified files in the wp-content/plugins/wordpress-popup/ directory with recent timestamps that were not part of legitimate updates
• Web server access logs showing requests to unfamiliar PHP files that did not exist in the original plugin installation

Detection Strategies

• Implement file integrity monitoring (FIM) on the WordPress installation to detect unauthorized file additions or modifications
• Configure web application firewall (WAF) rules to inspect file upload requests for executable content or suspicious extensions
• Enable WordPress security plugins that monitor for unauthorized file uploads and alert on new PHP files in unexpected locations
• Review server access logs for POST requests to the Hustle plugin's import functionality from low-privileged user accounts

Monitoring Recommendations

• Monitor WordPress user activity logs for Subscriber-level or other low-privileged accounts accessing the Hustle admin pages
• Set up alerts for permission changes that grant module edit access to non-administrative users
• Implement real-time file system monitoring to detect new executable files in the web root
• Review PHP error logs for execution attempts from newly created or modified files

How to Mitigate CVE-2026-0911

Immediate Actions Required

• Update the Hustle plugin to the latest patched version immediately
• Audit and revoke unnecessary Hustle module permissions from non-administrative users
• Review existing files in the WordPress installation for any suspicious uploads that may indicate prior exploitation
• Temporarily disable the Hustle plugin if an immediate update is not possible

Patch Information

A security patch has been released to address this vulnerability. The fix is available in the WordPress Plugin Change Log. Site administrators should update the Hustle – Email Marketing, Lead Generation, Optins, Popups plugin to the latest version beyond 7.8.9.2 to receive the security fix.

For detailed vulnerability information and tracking, refer to the Wordfence Vulnerability Report.

Workarounds

• Restrict Hustle module permissions to only trusted administrator accounts until the patch can be applied
• Implement additional file upload restrictions at the web server level to block executable file types
• Use a web application firewall (WAF) to filter malicious file upload attempts targeting the plugin
• Consider temporarily deactivating the plugin on high-value sites until the update can be thoroughly tested and deployed

# WordPress CLI command to update the Hustle plugin
wp plugin update wordpress-popup

# Verify current plugin version after update
wp plugin get wordpress-popup --field=version

# List users with Hustle module permissions for audit
wp user list --role=subscriber --format=table