CVE-2026-9656 is a sensitive information exposure vulnerability in the HubSpot All-In-One Marketing – Forms, Popups, Live Chat WordPress plugin. Authenticated users with contributor-level privileges or higher can extract the site's plaintext HubSpot OAuth refresh token from the window.leadinConfig JavaScript object. Although the token is encrypted at rest using AES-256-CTR, it is decrypted server-side before being passed to wp_localize_script(), exposing it in the client-side JavaScript context. This exposure could allow attackers to access or modify data in the associated HubSpot tenant. The vulnerability affects all versions up to and including 11.3.62. No official patch or remediation level has been published as of the data provided.

An attacker with contributor-level or higher access to the WordPress site can obtain the plaintext HubSpot OAuth refresh token, which could be used to access or modify data in the connected HubSpot tenant. This compromises the confidentiality of sensitive authentication credentials and potentially the integrity of data managed through HubSpot. The vulnerability does not impact availability and requires authenticated access, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity related to HubSpot integrations. Avoid exposing sensitive tokens in client-side scripts. Follow vendor updates closely for any released patches or official mitigations.