CVE-2026-9656 Overview
CVE-2026-9656 is a sensitive information exposure vulnerability [CWE-200] affecting the HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress. All versions up to and including 11.3.62 expose the site's plaintext HubSpot OAuth refresh token via the window.leadinConfig JavaScript object emitted by wp_localize_script(). Authenticated users with contributor-level access or higher can read the token from rendered pages. An attacker who extracts the refresh token can access or modify data in the connected HubSpot tenant. Although the token is stored at rest with AES-256-CTR encryption, the plugin decrypts it server-side before passing it to wp_localize_script(), defeating the at-rest protection.
Critical Impact
Authenticated contributors can harvest the HubSpot OAuth refresh token and pivot to the connected HubSpot tenant to access or alter marketing data, contacts, and forms.
Affected Products
- HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress (plugin slug leadin)
- All versions up to and including 11.3.62
- Fixed in version 11.3.64
Discovery Timeline
- 2026-07-17 - CVE-2026-9656 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-9656
Vulnerability Analysis
The HubSpot leadin plugin authenticates to the HubSpot API using an OAuth refresh token issued when the site is connected to a HubSpot portal. The plugin stores the refresh token in the WordPress database encrypted with AES-256-CTR. During page rendering for authenticated users, the plugin decrypts the token server-side and hands the plaintext value to WordPress's wp_localize_script() function. WordPress then serializes that value into the window.leadinConfig JavaScript object and emits it inline in the HTML response.
Any authenticated user who can trigger a page render containing this script, including contributor-level accounts, receives the plaintext refresh token in the HTML source. The attacker can then exchange the refresh token for HubSpot access tokens and interact with the connected HubSpot tenant outside the WordPress site.
Root Cause
The root cause is a mismatch between the sensitivity of the OAuth refresh token and the audience of wp_localize_script() output. Data passed to wp_localize_script() is intended for client-side JavaScript consumption and is visible to every user who renders the enqueued script. The plugin treated the localized object as a trusted server-to-script channel and included secret material that should never leave the server.
Attack Vector
An attacker first obtains contributor-level or higher credentials on the WordPress site through phishing, credential stuffing, or an existing low-privileged account. The attacker authenticates and requests an admin or editor screen that enqueues the plugin's scripts. The rendered HTML contains the window.leadinConfig object with the plaintext refresh token. The attacker copies the token, calls the HubSpot OAuth token endpoint with grant_type=refresh_token, and receives an access token scoped to the connected HubSpot portal. From there, the attacker can read contacts, forms, and analytics or modify HubSpot assets tied to the tenant. No user interaction beyond the attacker's own authenticated session is required, and no additional exploit code is needed.
Detection Methods for CVE-2026-9656
Indicators of Compromise
- Presence of the plaintext refreshToken or refresh_token field inside the window.leadinConfig object in rendered admin or editor HTML.
- Unexpected HubSpot API activity from IP addresses that do not match the WordPress host, including token-refresh calls to api.hubapi.com/oauth/v1/token.
- HubSpot audit-log entries showing data exports, contact modifications, or workflow changes not initiated by known administrators.
- Contributor or author accounts accessing plugin admin pages that they do not need for their role.
Detection Strategies
- Inventory WordPress installations for the leadin plugin and flag any instance at version 11.3.62 or earlier.
- Inspect page source for authenticated sessions and search for leadinConfig combined with refreshToken string patterns.
- Correlate HubSpot API access logs against the WordPress site's egress IP to detect refresh-token reuse from external hosts.
- Review WordPress user roles and recent role changes to identify unnecessary contributor-and-above accounts.
Monitoring Recommendations
- Enable HubSpot portal audit logging and alert on new OAuth access tokens issued from unfamiliar IP ranges.
- Log and alert on WordPress logins from anomalous geolocations for contributor, author, editor, and administrator roles.
- Monitor outbound requests from the WordPress host to HubSpot endpoints and baseline expected volume.
- Track plugin file changes and version transitions through file integrity monitoring on wp-content/plugins/leadin.
How to Mitigate CVE-2026-9656
Immediate Actions Required
- Update the HubSpot All-In-One Marketing plugin to version 11.3.64 or later on every WordPress site.
- Disconnect and reconnect the HubSpot integration to invalidate the exposed refresh token and force issuance of a new one.
- Rotate any HubSpot API credentials or private app tokens associated with the affected portal.
- Audit HubSpot portal activity for unauthorized access, contact exports, or workflow modifications since the plugin was installed.
Patch Information
The vendor addressed the issue in plugin version 11.3.64. The changeset between 11.3.62 and 11.3.64 is available in the WordPress Plugin Version Change Log. Additional technical context is published in the Wordfence Vulnerability Intel Report and in the vendor source references for Admin Constants, Gutenberg integration, OAuth handling, and the Assets Manager.
Workarounds
- Temporarily deactivate the leadin plugin until the patched version can be deployed.
- Restrict contributor, author, and editor accounts by removing untrusted users and enforcing multi-factor authentication for all WordPress logins.
- Revoke the HubSpot OAuth connection from the HubSpot portal side to invalidate any refresh tokens the plugin previously exposed.
- Apply web application firewall rules to block anonymous or low-privileged access to admin-area URLs where the plugin enqueues scripts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
