CVE-2026-0911 is a CWE-434 vulnerability in the Hustle – Email Marketing, Lead Generation, Optins, Popups WordPress plugin. It arises from incorrect validation of uploaded file types in the action_import_module() function, allowing authenticated users with low privileges to upload arbitrary files. Successful exploitation depends on an admin granting the attacker module permissions or edit access, which provides access to the Hustle admin interface and a required nonce. This flaw can potentially enable remote code execution on the server hosting the vulnerable plugin. The vulnerability affects all versions up to and including 7.8.9.2.

An attacker with low-level authenticated access can upload arbitrary files to the server, which may lead to remote code execution if exploited. This compromises the confidentiality, integrity, and availability of the affected system. The attack requires prior privilege escalation or permission granting by an administrator, limiting the ease of exploitation. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should avoid granting Hustle module permissions or edit access to low-privileged users. Restrict access to the Hustle admin page and monitor for unauthorized permission changes. Follow vendor updates closely for an official fix or temporary mitigation.