CVE-2026-73396 is classified as CWE-288, indicating an authentication bypass via an alternate path or channel in the MWB HubSpot for WooCommerce plugin. The vulnerability affects versions up to 1.6.7 and allows an attacker with low privileges to bypass authentication controls without user interaction. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. No known exploits are reported in the wild, and no vendor advisory or patch is currently available.

An attacker with low privileges can bypass authentication mechanisms, potentially leading to unauthorized actions that affect the integrity of the system and cause high availability impact. Confidentiality is not impacted. The vulnerability could disrupt normal operations or allow unauthorized modifications within the affected plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No specific mitigations are provided by the vendor at this time.