# CVE-2026-2263: WPMU DEV Hustle missing authorization in AJAX conversion tracking

Source: https://junglewise.ai/threats/cve-2026-2263-wpmu-dev-hustle-missing-authorization-in-ajax-conversion-tracking  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-2263 · Severity: medium · CVSS 5.3 · Published 2026-04-08

The Hustle plugin for WordPress, which is used for email marketing and lead generation popups, contains a security flaw that allows unauthorized users to tamper with marketing data. An attacker can remotely trigger fake conversion events, even for marketing campaigns that are not currently active or visible to the public. This can lead to inaccurate business analytics, skewed performance metrics, and unreliable marketing reports.

Technologies: [WPMU DEV Hustle](https://junglewise.ai/threats/technologies/hustle). Vendors: [WPMU DEV](https://junglewise.ai/threats/vendors/wpmu-dev).

## Quick answers

**Is CVE-2026-2263 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2263 being exploited in the wild.

**How severe is CVE-2026-2263?** Medium severity, with a CVSS score of 5.3, published 8 April 2026.

**Which products and versions are affected?** WPMU DEV Hustle Up to and including 7.8.10.2.

**Is there a fix for CVE-2026-2263?** A patch was published on 2026-04-08: Fixed in version 7.8.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2263 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-2263?** Check whether you run WPMU DEV Hustle at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as a missing authorization check (CWE-862) within the 'hustle_module_converted' AJAX action. Because the plugin fails to verify the permissions of the user initiating the request, any unauthenticated network actor can send forged requests to the server. This allows for the creation of fraudulent conversion tracking events for any Hustle module, including those in draft status. The primary impact is the loss of integrity for marketing and conversion statistics. The issue is addressed in version 7.8.11.

## Affected products

- WPMU DEV Hustle – Email Marketing, Lead Generation, Optins, Popups Up to and including 7.8.10.2

## Timeline

- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched: Fixed in version 7.8.11

## References

- [https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.9.3/inc/front/hustle-module-front-ajax.php](https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.9.3/inc/front/hustle-module-front-ajax.php)
- [https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.9.3/inc/front/hustle-module-front-ajax.php](https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.9.3/inc/front/hustle-module-front-ajax.php)
- [https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.9.3/inc/front/hustle-module-front.php](https://plugins.trac.wordpress.org/browser/wordpress-popup/tags/7.8.9.3/inc/front/hustle-module-front.php)
- [https://plugins.trac.wordpress.org/changeset?old_path=/wordpress-popup/tags/7.8.10.2&new_path=/wordpress-popup/tags/7.8.11](https://plugins.trac.wordpress.org/changeset?old_path=/wordpress-popup/tags/7.8.10.2&new_path=/wordpress-popup/tags/7.8.11)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/2305462c-0a00-4423-8dc2-e32628c4864d?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/2305462c-0a00-4423-8dc2-e32628c4864d?source=cve)

## Related threats

- [WPMU DEV Hustle missing authorization in access control](https://junglewise.ai/threats/cve-2026-25431-wpmu-dev-hustle-missing-authorization-in-access-control)