CVE-2025-11762: 
WordPress vulnerability analysis and mitigation

CVE-2025-11762 is a Sensitive Information Exposure vulnerability in the HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress. It affects all versions up to and including 11.3.32, allowing authenticated attackers with Contributor-level access or above to extract a list of all installed plugins and their versions via the leadin/public/admin/class-adminconstants.php file. The vulnerability was published on April 24, 2026, with a patch available in version 11.3.33. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to perform adequate authorization checks when an authenticated user accesses the leadin/public/admin/class-adminconstants.php file, which exposes a list of all installed WordPress plugins and their version numbers. The attack vector is network-based, requires low privileges (Contributor-level account), no user interaction, and low attack complexity. An attacker with a valid WordPress account at Contributor level or above can directly access the vulnerable file endpoint to retrieve plugin inventory data, which can then be used to identify vulnerable plugins for further exploitation (GitHub Advisory, Wordfence).

Successful exploitation results in limited confidentiality impact — specifically, the disclosure of the complete inventory of installed WordPress plugins and their version numbers to any authenticated Contributor-level user. While there is no direct integrity or availability impact, the exposed plugin list enables targeted reconnaissance, allowing attackers to identify additional vulnerable plugins installed on the site and plan follow-on attacks. This information disclosure can serve as a stepping stone toward more severe compromises of the WordPress installation (GitHub Advisory, Wordfence).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.025–0.032%, placing it in the 10th percentile for exploitation likelihood within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Obtain Contributor-level access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site running HubSpot All-In-One Marketing plugin version ≤ 11.3.32.
2. Identify the vulnerable endpoint: Navigate to or send an authenticated HTTP GET request to the leadin/public/admin/class-adminconstants.php file within the WordPress plugin directory.
3. Extract plugin inventory: Parse the response to obtain the full list of installed WordPress plugins and their version numbers exposed by the file.
4. Conduct reconnaissance: Cross-reference the enumerated plugins and versions against known vulnerability databases (e.g., WPScan, NVD) to identify additional attack vectors on the target WordPress installation (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing authenticated GET requests to /wp-content/plugins/leadin/public/admin/class-adminconstants.php from Contributor-level user accounts, especially in rapid succession or from unusual IP addresses.
• Logs: Multiple requests to the above path from the same authenticated session in a short timeframe, suggesting automated enumeration.
• Network: Outbound connections or data transfers following access to the vulnerable file, potentially indicating exfiltration of plugin inventory data for use in follow-on attacks.

Update the HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin to version 11.3.33 or later, which addresses the missing authorization check in the affected file (GitHub Advisory, WordPress Trac). As an interim measure, review and restrict Contributor-level user accounts to only those who genuinely require that access level. Monitor access logs for suspicious requests to the class-adminconstants.php file from low-privileged accounts.

The vulnerability was reported and disclosed by Wordfence, which maintains a dedicated threat intelligence entry for this CVE. CleanTalk Research also published a brief analysis at the time of disclosure. Coverage has been limited to standard vulnerability aggregation sites and the CISA weekly vulnerability bulletin for the week of April 20, 2026, with no notable broader community or media reaction given the moderate severity rating (Wordfence, CleanTalk Research).