CVE-2026-103075 Overview
CVE-2026-103075 is a Missing Authorization vulnerability [CWE-862] in the WPMU DEV Hustle plugin for WordPress, also known as wordpress-popup. The flaw affects all versions up to and including 7.8.14.2. Authenticated users with low privileges can reach plugin functionality that should be restricted to higher-privileged roles. The vulnerability stems from incorrectly configured access control checks in the plugin's request handlers.
Critical Impact
Authenticated attackers with low privileges can access plugin functions that disclose limited confidential information, affecting the confidentiality of data managed by the Hustle plugin.
Affected Products
- WPMU DEV Hustle (wordpress-popup) plugin for WordPress
- All versions from n/a through 7.8.14.2
- WordPress sites with the Hustle plugin installed and active
Discovery Timeline
- 2026-10-07 - CVE-2026-103075 published to the National Vulnerability Database
- 2026-10-07 - Last updated in NVD database
Technical Details for CVE-2026-103075
Vulnerability Analysis
The Hustle plugin provides opt-in forms, pop-ups, and marketing modules for WordPress sites. The vulnerability allows users with limited privileges to call plugin endpoints that assume a higher privilege level. The access control logic does not verify role or capability before executing sensitive operations.
The impact is limited to confidentiality. An attacker cannot modify data or disrupt service through this flaw. However, the exposed functions can leak plugin-managed information to any authenticated user on the site.
Root Cause
The root cause is a missing authorization check [CWE-862] in one or more plugin request handlers. The code validates authentication but not authorization. Any logged-in user, including subscribers created through open registration, satisfies the privilege requirement enforced by the vulnerable code path.
Attack Vector
Exploitation requires network access to the WordPress site and a valid low-privilege account. The attacker sends crafted HTTP requests to the exposed plugin endpoints. No user interaction is required. See the Patchstack Vulnerability Report for additional technical context.
No verified proof-of-concept code is published. The vulnerability mechanism is described in prose only.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-103075
Indicators of Compromise
- Unexpected HTTP requests from low-privilege authenticated sessions targeting Hustle plugin AJAX actions or REST routes under /wp-admin/admin-ajax.php or /wp-json/.
- Access logs showing subscriber-level users calling Hustle administrative endpoints.
- Unexplained reads of Hustle module configuration or subscriber list data.
Detection Strategies
- Review WordPress audit logs for Hustle plugin endpoint calls initiated by non-administrator roles.
- Correlate web server access logs with user role metadata to identify privilege mismatches on plugin requests.
- Deploy web application firewall rules that flag Hustle AJAX or REST calls from subscriber or customer roles.
Monitoring Recommendations
- Monitor the wp_users and wp_usermeta tables for new low-privilege accounts followed by Hustle endpoint access.
- Alert on bursts of requests to plugin-specific actions matching hustle_* parameter names.
- Track installed plugin versions across managed WordPress sites and flag Hustle installations at or below 7.8.14.2.
How to Mitigate CVE-2026-103075
Immediate Actions Required
- Update the Hustle plugin to a version released after 7.8.14.2 as soon as the vendor publishes a fixed release.
- Audit user roles and remove unused low-privilege accounts, especially on sites with open registration enabled.
- Review the Patchstack advisory for the latest patched version information.
Patch Information
The vendor advisory tracked by Patchstack identifies Hustle versions through 7.8.14.2 as vulnerable. Administrators should consult the Patchstack Vulnerability Report for current fixed-version guidance and apply the update through the WordPress plugin manager.
Workarounds
- Disable the Hustle plugin until a patched version is installed if the plugin is not business-critical.
- Restrict access to /wp-admin/admin-ajax.php and /wp-json/hustle/ routes from untrusted authenticated roles using a web application firewall.
- Disable open user registration on sites where subscriber accounts are not required.
# Configuration example: list and update the Hustle plugin via WP-CLI
wp plugin list --name=wordpress-popup --fields=name,status,version
wp plugin update wordpress-popup
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
