Vulnerability · Published Sep 9, 2026 · Assigned by WPScan
CVE-2026-80440Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders
Medium 4.8
In plain English
A medium-severity injection in Hustle from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.2%top 84.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.
Affected products (as reported)
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://wpscan.com/vulnerability/7b86b462-e021-4906-bbf3-bf83f89a03ee/ exploit, vdb-entry, technical-description