HubSpot All-In-One Marketing <= 11.3.62 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script
Strategic Overview
- Status
- Patched in 11.3.64
- Affected Plugin
- HubSpot All-In-One Marketing – Forms, Popups, Live Chat
- Affected Version
<= 11.3.62- CVSS
- 4.3Medium
- Weakness type
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- CVE
CVE-2026-9656
At a glance
CVE-2026-9656 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the HubSpot All-In-One Marketing WordPress plugin, affecting versions <= 11.3.62. It carries a CVSS score of 4.3 (reachable over the network; low attack complexity). Exploitation requires an authenticated account at Contributor level or above. The issue is fixed in version 11.3.64; sites on affected versions should update now. Disclosed July 2026, reported by anhcd05.
Vulnerability Overview
The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.62 via the wp_localize_script() / window.leadinConfig JavaScript object. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the site's plaintext HubSpot OAuth refresh token exposed via the window.leadinConfig JavaScript object, which can then be used to access or modify data in the connected HubSpot tenant. Although the refresh token is stored at rest with AES-256-CTR encryption, decryption occurs server-side before the plaintext value is passed to wp_localize_script(), rendering the at-rest encryption ineffective against this exposure path.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
HubSpot All-In-One Marketing <= 11.3.62 carries this weakness at wp_localize_script(), and reaching it takes an account at Contributor level or above. Sensitive information exposure means data the application intended to keep internal is returned to a caller who should not be able to see it.
The disclosed data — credentials, tokens, customer records or internal paths — is usually worth more as material for a follow-up attack than as an end in itself. For HubSpot All-In-One Marketing the fix is 11.3.64: builds <= 11.3.62 are affected, anything from 11.3.64 onward is not.
Remediation
Update to version 11.3.64, or a newer patched version
How does WordSec protect against this?
The fix is the thing that ends this: HubSpot All-In-One Marketing 11.3.64 closes this, and updating the plugin is the step that ends it.
- Alerts
External References
Related records
Same weakness class
Other vulnerabilities in HubSpot All-In-One Marketing – Forms, Popups, Live Chat
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C