CVE-2025-11762 affects HubSpot All-In-One Marketing – Forms, Popups, Live Chat and is an authenticated Contributor+ sensitive information exposure caused by missing authorization. Vulnerable versions through 11.3.32 expose the complete installed plugin inventory and version data through the global leadinConfig JavaScript object on pages available to users with edit_posts, giving low-privileged accounts useful reconnaissance data for follow-on attacks.
| CVE | CVE-2025-11762 |
| Plugin Version | HubSpot All-In-One Marketing – Forms, Popups, Live Chat <= 11.3.32, fixed in 11.3.33 |
| All Time | 20 508 198 |
| Active installations | 200 000+ |
| Publicly Published | April 23, 2026 |
| Last Updated | April 24, 2026 |
| Researcher | Dmitrii Ignatyev |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2025-11762 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/leadin/hubspot-all-in-one-marketing-forms-popups-live-chat-11332-missing-authorization-to-authenticated-contributor-installed-plugin-disclosure |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| September 22, 2025 | Plugin testing and vulnerability detection in HubSpot All-In-One Marketing were completed. |
| September 22, 2025 | The vulnerability was reported with PoC, description, and recommendations for remediation. |
| April 23, 2026 | CVE-2025-11762 was publicly published by Wordfence. |
Discovery of the Vulnerability
The vulnerable data is assembled in leadin/public/admin/class-adminconstants.php. Around lines 151 to 178, the plugin adds the result of get_plugins() to the plugins entry in a configuration array. That function returns the complete installed plugin inventory, including version metadata. WordPress normally keeps this information behind the activate_plugins capability.
leadin/public/class-assetsmanager.php then passes the configuration to multiple wp_localize_script() calls around lines 39, 160, 169, and 182. The resulting leadinConfig object is present on plugin admin pages and in Gutenberg for users who have edit_posts. Because Contributor and Author accounts meet that threshold, the data crosses the intended administration boundary.
Understanding of Missing Authorization attacks
In WordPress, page access and script localization need distinct authorization review. The edit_posts capability only proves that the user may create content. It does not grant permission to enumerate software installed by an administrator. Exposing plugin names and exact versions gives a low-privileged attacker a reliable component inventory that can be matched against known vulnerabilities.
Exploiting the Missing Authorization Vulnerability
The following non-destructive PoC was confirmed on HubSpot 11.3.21 with an Author account. It reads an existing browser object and does not modify site data.
POC:
POC: 1. Log in to WordPress as an Author. 2. Open the Gutenberg post editor. 3. Open the browser developer console. 4. Run leadinConfig.plugins. 5. Observe a complete associative array of installed plugins and their versions.____
On a vulnerable installation, leadinConfig.plugins returns plugin file paths, names, and exact version details even though the Author account cannot activate or manage plugins.
Recommendations for Improved Security
Site owners should update HubSpot All-In-One Marketing to version 11.3.33 or later. Developers should remove get_plugins() data from global client-side configuration unless the current user has activate_plugins and the page requires it. A safer default is to avoid sending the inventory at all. Any necessary admin-only configuration should be localized only on narrowly scoped screens after a current_user_can() check.
By addressing Missing Authorization issues like CVE-2025-11762, WordPress site owners can reduce unnecessary software inventory disclosure and limit reconnaissance by low-privileged accounts. Stay vigilant, stay secure.
#WordPressSecurity #MissingAuthorization #InformationDisclosure #WebsiteSafety #StayProtected #MediumVulnerability
Use CleanTalk solutions to improve the security of your website
