Lucene search

WordfenceCVE-2024-0368

HistoryMar 13, 2024 - 4:15 p.m.

CVE-2024-0368

2024-03-1316:15:10

Wordfence

web.nvd.nist.gov

cve-2024-0368

hustle

email marketing

lead generation

wordpress

api keys

information exposure

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

8.8

Confidence

High

EPSS

Percentile

15.5%

JSON

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII.

Affected configurations

Vulners

Vulnrichment

Node

wpmudevhustle_–_email_marketing\,_lead_generation\,_optins\,_popupsRange≤7.8.3wordpress

VendorProductVersionCPE
wpmudevhustle_–_email_marketing\,_lead_generation\,_optins\,_popups*cpe:2.3:a:wpmudev:hustle_–_email_marketing\,_lead_generation\,_optins\,_popups:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wpmudev	hustle_–_email_marketing\,_lead_generation\,_optins\,_popups	*	cpe:2.3:a:wpmudev:hustle_–_email_marketing\,_lead_generation\,_optins\,_popups::::::wordpress::*

CNA Affected

[
  {
    "vendor": "wpmudev",
    "product": "Hustle – Email Marketing, Lead Generation, Optins, Popups",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "7.8.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

developers.hubspot.com/docs/api/webhooks#manage-settings-via-api

developers.hubspot.com/docs/api/webhooks#scopes

plugins.trac.wordpress.org/browser/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php#L13

plugins.trac.wordpress.org/changeset/3047775/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php?old=3025070&old_path=wordpress-popup/tags/7.8.3/inc/providers/hubspot/hustle-hubspot-api.php

www.wordfence.com/threat-intel/vulnerabilities/id/e6d40b41-540d-476d-afde-970845543933?source=cve

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

8.8

Confidence

High

EPSS

Percentile

15.5%

JSON

Related for CVE-2024-0368