CVE-2026-2263Disclosure

LOWCVSS 5.3 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hustle_module_converted' AJAX action in all versions up to, and including, 7.8.10.2. This makes it possible for unauthenticated attackers to forge conversion tracking events for any Hustle module, including draft modules that are never displayed to users, thereby manipulating marketing analytics and conversion statistics.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
3 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-04-08); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification3 categories

Disclosure

133.3%

General

133.3%

PoC

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-08	2	Disclosure1General1
2026-04-20	1	PoC1

Full discourse3 posts

Atomic Edge@atomicedgeWAF171d
PoC
https://atomicedge.io/cve-proof/cve-2026-2263-wordpress-popup-version-7-8-10-2-medium-vulnerability-proof-of-concept CVE-2026-2263 #WordPress plugin #vulnerability wordpress-popup #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
CVE-2026-2263 in the WordPress plugin 'wordpress-popup' (v7.8.10-2) has been disclosed with a proof‑of‑concept available via the provided link, but no patches, active exploitation, or false positive claims are mentioned.
0000046
6 followersView on X
CVEarity@CVEarity183d
General
⚡ New CVE Alert: CVE-2026-2263 📊 Severity: 5.3 🚨 Risk Level: Medium 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-2263 #CVE-2026-2263 #CVE #Medium #Wordpress #CyberSecurity #InfoSec https://t.co/FrxgvbKm03
Post summary
The tweet announces a new CVE affecting WordPress with a medium severity rating but offers no technical details, exploit information, or evidence of active exploitation.
0000041
123 followersView on X
CVE@CVEnew183d
Disclosure
CVE-2026-2263 The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check … https://www.cve.org/CVERecord?id=CVE-2026-2263
Post summary
The post simply announces that the CVE-2026-2263 vulnerability exists in The Hustle WordPress plugin, highlighting its missing capability check without providing exploitation details or patches.
00000126
57.0K followersView on X

Explore more

Back to dashboard