CVE-2026-57736 HIGH

CVE-2026-57736: WordPress HubSpot plugin <= 11.3.51 - Sensitive Data Exposure vulnerability

Vendor Hubspot

Product HubSpot

Weakness CWE-201

Published July 1, 2026

Last update July 1, 2026

View on NVD All CVEs

CVSS base score

7.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: from n/a through 11.3.51.

Explanation of Vulnerability in Simple Terms

02Summary

HubSpot versions up to 11.3.51 contain an information disclosure vulnerability affecting authenticated users. An attacker with low-level account access can view sensitive data across the platform and make unauthorized changes due to insufficient access controls. The vulnerability has scope impact, meaning effects may extend beyond the vulnerable component. Patched versions are not yet publicly identified.

What an attacker can do

03Attacker Capabilities

Read sensitive data and make unauthorized changes across the HubSpot platform.

Potential impact on your site

04Site Impact

Authenticated users with limited permissions can access and modify data they should not be able to, risking data breach and unauthorized account changes.

Conditions required to exploit

05Prerequisites

Attacker must have a valid HubSpot account with low-level privileges; no user interaction required.

Key dates

06Disclosure timeline

July 1, 2026 CVE published

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-57736 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/201.html AskarLabs — CWE-201 write-up Insertion of Sensitive Information Into Sent Data

Related vulnerabilities