Hustle – Email Marketing, Lead Generation, Optins, Popups < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Remote Code Execution in all versions up to 7.8.14.2. This is due to use of strip_shortcodes on submitted field values, which can be bypassed by nesting brackets, instead of encoding square brackets to prevent shortcode formation entirely. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered on the site by submitting bracket-nested shortcode payloads in form fields that are reflected in the post-submission success message.

Requests carrying this pattern arrive without a session, so nothing upstream of the firewall gets a chance to reject them: WordSec's web application firewall inspects request payloads before WordPress loads them. Classes like this one can leave something behind, so the staged malware scanner is the second half: it looks for dropped files and modified code rather than for the request that created them. None of that substitutes for the fix: Hustle 7.8.14.2 closes this, and updating the plugin is the step that ends it.

• Firewall
• Scanner
• Login Security