CVE-2024-0368 is a vulnerability in the wpmudev Hustle WordPress plugin (up to version 7.8.3) where hardcoded API keys are present, leading to sensitive information exposure. This flaw allows unauthenticated attackers to extract sensitive data, including PII, due to insufficient protection of credentials (CWE-522). The vulnerability has a CVSS 3.1 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No patch or official remediation guidance is currently available from the vendor.

An unauthenticated attacker can exploit this vulnerability remotely to obtain hardcoded API keys embedded in the plugin, which may expose sensitive data including personally identifiable information. The confidentiality impact is high, but integrity and availability are not affected. This could lead to unauthorized data disclosure and potential privacy violations for users of the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the Hustle plugin or restricting access to the plugin files to prevent unauthorized access. Monitor official wpmudev communications for updates and apply any forthcoming patches promptly.