WordPress Hustle Plugin Missing Authorization to Unauthorized Form Submission (CVE-2024-10580)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Hustle - Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission 2. Vulnerability Description: - The Hustle plugin for WordPress contains a vulnerability allowing unauthorized form submission, due to the function lacking permission checks in all versions (including 7.8.5). - This enables unauthorized attackers to submit unpublished forms. 3. Vulnerability Rating: - CVSS Score: 3.1 - CVSS Rating Level: Medium (Medium) 4. Public Release Date: November 26, 2024 5. Last Updated Date: November 27, 2024 6. Researcher: Vijaysimha Reddy (vijaysimha) 7. Vulnerability ID: CVE-2024-10580 8. Affected Versions: <= 7.8.5 9. Fixed Version: 7.8.6 10. Remediation Recommendation: Upgrade to version 7.8.6 or later, which includes the fix. 11. Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org 12. Vulnerability Details: - Includes detailed information such as software type, software slug, fix status, remediation advice, etc. 13. Copyright and Licensing Information: - Provides copyright and licensing details, including copyright notices and license terms from Defiant Inc. and MITRE Corporation. 14. Vulnerability Database: - Offers the Wordfence Intelligence WordPress vulnerability database, which is completely free and accessible via API for querying. 15. Notification Service: - Provides the Wordfence plugin, which can be installed on WordPress websites to receive real-time notifications about vulnerabilities that may affect the site. 16. Documentation and Resources: - Offers documentation and resources for the Wordfence plugin, including the Learning Center, free support, and advanced support. 17. Contact Us: - Provides an email address for contacting Wordfence support: wfi-support@wordfence.com. This information helps users understand and assess the risk associated with the Hustle plugin vulnerability and take appropriate security measures.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Hustle Plugin Missing Authorization to Unauthorized Form Submission (CVE-2024-10580)