Authorization Bypass in Hustle Email Marketing Plugin for WordPress

CVE-2026-109386

What is CVE-2026-109386?

The Hustle Email Marketing plugin for WordPress is exposed to an authorization bypass vulnerability. This flaw arises from inadequate validation of user permissions, allowing authenticated attackers with custom access level or higher to manipulate site integration credentials for external Email Service Providers (ESPs) such as AWeber, Constant Contact, Infusionsoft, ConvertKit, and HubSpot. Consequently, these attackers can redirect form submissions to their own ESP accounts, leading to potential data theft and exploitation. In the case of HubSpot, this vulnerability can also lead to the irreversible deletion of critical OAuth tokens and settings. Attackers must possess the hustle_create capability to exploit this vulnerability, allowing them to access and execute specific actions within the Hustle module.

References