CVE-2026-2263

VULNERABILITY BRIEFING NOTE The Hustle WordPress plugin (versions up to 7.8.10.2) contains a missing capability check vulnerability in its AJAX conversion tracking functionality, allowing unauthenticated attackers to forge conversion events for any module without authentication. This vulnerability affects websites using the popular email marketing, lead generation, and popup plugin across all impacted versions. The vulnerability presents a medium-severity risk with a CVSS score of 5.3, exploitable remotely without special access requirements or user interaction. The primary impact is integrity compromise, enabling attackers to manipulate marketing analytics and conversion statistics by submitting false conversion data, including for draft modules never exposed to legitimate users. Current exploitation status indicates the vulnerability remains inactive on the Known Exploited Vulnerabilities catalog with no public exploit code readily available. The EPSS score of 0.0005 reflects minimal observed exploitation in the wild, suggesting low immediate threat despite the straightforward attack vector and lack of authentication requirements.