{"api_version":"1","generated_at":"2026-04-23T06:20:07+00:00","cve":"CVE-2024-0368","urls":{"html":"https://cve.report/CVE-2024-0368","api":"https://cve.report/api/cve/CVE-2024-0368.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-0368","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-0368"},"summary":{"title":"Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys","description":"The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII.","state":"PUBLISHED","assigner":"Wordfence","published_at":"2024-03-13 16:15:10","updated_at":"2026-04-08 19:19:08"},"problem_types":["CWE-522","NVD-CWE-Other","CWE-522 CWE-522 Insufficiently Protected Credentials"],"metrics":[{"version":"3.1","source":"security@wordfence.com","type":"Secondary","score":"8.6","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.6","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","data":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://developers.hubspot.com/docs/api/webhooks#scopes","name":"https://developers.hubspot.com/docs/api/webhooks#scopes","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d40b41-540d-476d-afde-970845543933?source=cve","name":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d40b41-540d-476d-afde-970845543933?source=cve","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php#L13","name":"https://plugins.trac.wordpress.org/browser/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php#L13","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://plugins.trac.wordpress.org/changeset/3047775/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php?old=3025070&old_path=wordpress-popup/tags/7.8.3/inc/providers/hubspot/hustle-hubspot-api.php","name":"https://plugins.trac.wordpress.org/changeset/3047775/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php?old=3025070&old_path=wordpress-popup/tags/7.8.3/inc/providers/hubspot/hustle-hubspot-api.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api","name":"https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-0368","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0368","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"wpmudev","product":"Hustle – Email Marketing, Lead Generation, Optins, Popups","version":"affected 7.8.3 semver","platforms":[]},{"source":"ADP","vendor":"wpmudev","product":"hustle","version":"affected 7.8.3 semver","platforms":[]}],"timeline":[{"source":"CNA","time":"2024-03-12T00:00:00.000Z","lang":"en","value":"Disclosed"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Sean Murphy","lang":"en"}],"nvd_cpes":[{"cve_year":"2024","cve_id":"368","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wpmudev","cpe5":"hustle","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2024","cve_id":"368","cve":"CVE-2024-0368","epss":"0.016840000","percentile":"0.822490000","score_date":"2026-04-22","updated_at":"2026-04-23 00:03:17"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-01T18:04:49.506Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_transferred"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d40b41-540d-476d-afde-970845543933?source=cve"},{"tags":["x_transferred"],"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php#L13"},{"tags":["x_transferred"],"url":"https://developers.hubspot.com/docs/api/webhooks#scopes"},{"tags":["x_transferred"],"url":"https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api"},{"tags":["x_transferred"],"url":"https://plugins.trac.wordpress.org/changeset/3047775/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php?old=3025070&old_path=wordpress-popup/tags/7.8.3/inc/providers/hubspot/hustle-hubspot-api.php"}],"title":"CVE Program Container"},{"affected":[{"cpes":["cpe:2.3:a:wpmudev:hustle:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"hustle","vendor":"wpmudev","versions":[{"lessThanOrEqual":"7.8.3","status":"affected","version":"0","versionType":"semver"}]}],"metrics":[{"other":{"content":{"id":"CVE-2024-0368","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-08-02T20:38:25.301715Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-08-02T20:39:27.616Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Hustle – Email Marketing, Lead Generation, Optins, Popups","vendor":"wpmudev","versions":[{"lessThanOrEqual":"7.8.3","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Sean Murphy"}],"descriptions":[{"lang":"en","value":"The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII."}],"metrics":[{"cvssV3_1":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-522","description":"CWE-522 Insufficiently Protected Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-08T17:30:15.925Z","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence"},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d40b41-540d-476d-afde-970845543933?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php#L13"},{"url":"https://developers.hubspot.com/docs/api/webhooks#scopes"},{"url":"https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api"},{"url":"https://plugins.trac.wordpress.org/changeset/3047775/wordpress-popup/trunk/inc/providers/hubspot/hustle-hubspot-api.php?old=3025070&old_path=wordpress-popup/tags/7.8.3/inc/providers/hubspot/hustle-hubspot-api.php"}],"timeline":[{"lang":"en","time":"2024-03-12T00:00:00.000Z","value":"Disclosed"}],"title":"Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys"}},"cveMetadata":{"assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","assignerShortName":"Wordfence","cveId":"CVE-2024-0368","datePublished":"2024-03-13T15:27:21.681Z","dateReserved":"2024-01-09T19:55:46.479Z","dateUpdated":"2026-04-08T17:30:15.925Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2024-03-13 16:15:10","lastModifiedDate":"2026-04-08 19:19:08","problem_types":["CWE-522","NVD-CWE-Other","CWE-522 CWE-522 Insufficiently Protected Credentials"],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wpmudev:hustle:*:*:*:*:*:wordpress:*:*","versionEndExcluding":"7.8.4","matchCriteriaId":"6DBE5624-1C28-43A2-AB06-3FA907954887"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"368","Ordinal":"1","Title":"Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hub","CVE":"CVE-2024-0368","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"368","Ordinal":"1","NoteData":"The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII.","Type":"Description","Title":"Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hub"}]}}}