The Hustle plugin for WordPress suffers from a missing capability check in its submit_form() function, which leads to unauthorized form submissions by unauthenticated users. This vulnerability is classified under CWE-862 (Missing Authorization) and affects all versions up to 7.8.5. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official fix information is provided in the data.

An attacker can submit unpublished forms without authentication, potentially leading to unauthorized data injection or manipulation of form submissions. There is no direct confidentiality or availability impact reported. The integrity impact is limited to the ability to submit forms that should be restricted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the plugin's form submission endpoints via other means such as web application firewalls or custom access controls to prevent unauthorized submissions.