Executive brief
The HubSpot plugin for WordPress, which integrates marketing tools like forms and live chat, contains a security flaw that exposes sensitive credentials. An authorized user with contributor-level access can view the site's HubSpot OAuth refresh token in plaintext. This token could allow an attacker to access or modify data within the connected HubSpot account, potentially compromising customer information or marketing operations.
Technical details
The HubSpot All-In-One Marketing plugin for WordPress is vulnerable to Sensitive Information Exposure (CWE-200) in versions up to and including 11.3.62. The vulnerability exists because the plugin uses the wp_localize_script() function to pass the HubSpot OAuth refresh token to the window.leadinConfig JavaScript object in plaintext. While the token is encrypted at rest using AES-256-CTR, it is decrypted server-side before being transmitted to the client-side script. An authenticated attacker with contributor-level permissions or higher can extract this token from the page source and use it to interact with the connected HubSpot tenant. A fix is available in version 11.3.64.
Affected products
- HubSpot HubSpot All-In-One Marketing – Forms, Popups, Live Chat <= 11.3.62
Timeline
- 2026-07-17: advisory: NVD publication date
- 2026-07-17: disclosed
References
- https://plugins.trac.wordpress.org/browser/leadin/tags/11.3.45/public/admin/class-adminconstants.php
- https://plugins.trac.wordpress.org/browser/leadin/tags/11.3.45/public/admin/class-gutenberg.php
- https://plugins.trac.wordpress.org/browser/leadin/tags/11.3.45/public/auth/class-oauth.php
- https://plugins.trac.wordpress.org/browser/leadin/tags/11.3.45/public/class-assetsmanager.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fleadin/tags/11.3.62&new_path=%2Fleadin/tags/11.3.64
- https://www.wordfence.com/threat-intel/vulnerabilities/id/718d7ea3-d8ba-46a0-9ab1-72657bd82c17?source=cve