CVE-2026-2263 describes a missing authorization (CWE-862) vulnerability in the Hustle – Email Marketing, Lead Generation, Optins, Popups WordPress plugin. The issue arises because the 'hustle_module_converted' AJAX action lacks a capability check, enabling unauthenticated attackers to submit forged conversion tracking events. This affects all versions up to and including 7.8.10.2. The vulnerability allows manipulation of marketing data, including draft modules that are not publicly displayed, potentially skewing analytics and conversion metrics. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

The vulnerability allows unauthenticated attackers to manipulate conversion tracking data for the Hustle plugin, potentially corrupting marketing analytics and conversion statistics. There is no impact on confidentiality or availability. No known exploits are reported in the wild. The integrity of marketing data is compromised, which could mislead business decisions based on inaccurate conversion metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, consider restricting access to the affected AJAX action or implementing custom authorization checks if feasible. Monitor vendor communications for updates on remediation.