Security Alert Summary
An information exposure vulnerability in the WPMU DEV Hustle (wordpress-popup) plugin can allow an unauthenticated actor to retrieve embedded sensitive system information. The issue affects Hustle through version 7.8.9.2. Site owners should review whether they use this plugin and assess any sensitive data that may be exposed.
CVE Details
- CVE ID: CVE-2026-24998
- Affected plugin / component: WPMU DEV – Your All-in-One WordPress Platform Hustle (wordpress-popup)
- Affected versions: “from n/a through <= 7.8.9.2.” (as stated in the CVE entry)
- Published: February 3, 2026 at 3:16:19 PM UTC
- Last modified: February 3, 2026 at 4:44:03 PM UTC
- CVSS v3.1 base score: 5.3 — MEDIUM
- CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Authentication / privileges / user interaction: No authentication required; Privileges Required: NONE; User Interaction: NONE (accessible over the network)
- Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- Weakness (CWE): CWE-497
- Fixed version: Not specified in the CVE entry
Technical Details
The CVE entry describes an “Exposure of Sensitive System Information to an Unauthorized Control Sphere” in the Hustle (wordpress-popup) plugin that “allows Retrieve Embedded Sensitive Data.” According to the supplied data, this condition permits an unauthenticated, network-accessing actor to obtain embedded sensitive information from the plugin.
The vulnerability exists because sensitive data embedded by the plugin can be retrieved without requiring privileges or user interaction (as indicated by the CVSS vector). The CVE description does not name specific functions, REST endpoints, or code paths; therefore this summary only reflects the documented behavior: embedded sensitive data is retrievable by an unauthorized party.
Impact is limited to disclosure of the embedded data (confidentiality impact is LOW). There is no documented integrity or availability impact in the CVE entry.
How This Could Impact Your Website
Consider a small team using Hustle on a WordPress site: the site owner installs the plugin, editors and contributors create popups and forms, and an external contractor manages marketing campaigns. If the plugin embeds system or configuration details (for example, internal identifiers, email addresses, or integration keys) in a way that this vulnerability exposes, an unauthenticated actor could retrieve those values.
Practical consequences include limited disclosure of internal information such as user emails or configuration details that could increase the risk of targeted phishing or social engineering against staff or contractors. The CVSS rating indicates a low confidentiality impact rather than site takeover; there is no indication in the CVE entry of integrity or availability compromise.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Monitor the plugin’s official advisories and update the affected plugin as soon as a patched version is published.
- Because the CVE lists affected versions through <= 7.8.9.2 and does not specify a fixed release, do not assume protection until an update is confirmed.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other non-administrative accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual access patterns or data retrieval attempts related to plugin endpoints.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
