Threats tagged 'ghsa-qhrf-9mrq-hpj6'

The Hustle WordPress plugin (up to version 7.8.14.3) has an authorization bypass vulnerability that allows authenticated users with the hustle_create capability to overwrite the site's active email service provider (ESP) integration credentials. This can redirect lead submissions to an attacker-controlled ESP account and, in the case of HubSpot, delete critical OAuth tokens irreversibly.