Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.1 - Missing Authorization

This exploitation research plan targets CVE-2026-25431, a missing authorization vulnerability in the Hustle plugin for WordPress.

1. Vulnerability Summary

The Hustle plugin (<= 7.8.10.1) is vulnerable to unauthorized access because the hustle_dismiss_notification AJAX action (and potentially others like tracking updates) is registered using wp_ajax_nopriv_ but fails to implement a capability check (e.g., current_user_can( 'manage_options' )). This allows unauthenticated attackers to perform actions intended for administrators, such as dismissing site-wide notifications or manipulating plugin state.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: hustle_dismiss_notification
• Authentication: None required (unauthenticated).
• Payload Parameter: name (the identifier of the notification to dismiss).
• Precondition: The plugin must be active. The target action must be registered in the wp_ajax_nopriv_ hook.

3. Code Flow

1. Frontend Entry: The JavaScript in assets/js/admin.min.js (specifically within Hustle.define("Modals.Welcome", ...) at module 197) triggers the dismissal.
2. Request Construction: The dismissModal function sends a POST request to `ajaxurl