CVE-2024-1526

Hubbub Lite < 1.33.1 - Unauthenticated Password Protected Posts Access

Public exploit available. Not confirmed exploited in the wild yet. Fixed in 1.33.1.

CVSS 3.15.3Medium EPSS percentile43rd0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source Fix1.33.1Upgrade to this build

Published 2024-04-01Updated 2025-06-10Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Unknown Hubbub LiteAffected: < 1.33.1Upgrade to: 1.33.1Stated by: CVE record
Devpups Social PugAffected: < 1.33.1Upgrade to: 1.33.1Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

In your WordPress admin area, check whether Hubbub Lite is installed and confirm its version.
Update Hubbub Lite to version 1.33.1 or later.
Review password-protected posts for information that should no longer be considered private, and change any exposed passwords.

Usually a quick update

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

The Hubbub Lite WordPress plugin before 1.33.1 does not ensure that user have access to password protected post before displaying its content in a meta tag.

In plain language

Written by AI from the record

Hubbub Lite versions before 1.33.1 can reveal the contents of password-protected posts, so affected small businesses should update.

Unauthenticated information disclosure in Hubbub Lite before 1.33.1 allows password-protected WordPress post content to be exposed through a meta tag.

If you're affected

Private post content exposed
Password protection bypassed
Sensitive business information disclosed

What is it

This issue can let a visitor see material from a post that was meant to require a password. It is like putting a locked document in a cabinet but leaving its contents visible through a label on the outside.

Who is affected

This matters to you if your WordPress site uses Hubbub Lite and has password-protected posts. It is especially relevant if those posts contain customer, financial, internal, or other non-public information. The exposed content may be reachable by people who visit the site.

How urgent is it

A public exploit is available, meaning someone has published a way to take advantage of this issue. Update promptly, particularly if password-protected posts contain sensitive information; it is not listed in the government’s known-exploited-vulnerabilities catalog.

What to do — in detail

Confirm whether Hubbub Lite is installed and identify the installed version in the WordPress Plugins page or your deployment records.
Treat versions earlier than 1.33.1 as affected and upgrade to 1.33.1 or a later supported release.
Test the update on a staging site first if your site has custom sharing integrations or custom WordPress changes, then deploy the update to production.
If upgrading is delayed, temporarily remove or unpublish sensitive password-protected posts, or move their contents to an access-controlled system.
Review web and application logs for unexpected access to affected post URLs and assess whether the text of sensitive protected posts needs to be replaced. CISA KEV does not provide a remediation due date because this CVE is not listed there.

Technical context

CVSS v3.1 is 5.3 (Medium): AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The issue is an unauthenticated information disclosure caused by the plugin displaying password-protected post content in a meta tag without confirming access. One public exploit is known, but the CVE is not listed in CISA KEV and the findings do not confirm exploitation in the wild. EPSS is 0.5% (43rd percentile) with a flat trend; this is a prediction, not evidence of active exploitation. Exploit maturity is public exploit available.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS43rd

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 43rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 704 days, from the signal feeds we watch.

2026-03-06Public exploit / PoCsource: othernuclei check added
2025-06-10Record updated
2024-04-01Publishedweakness classified

Affected products

devpupscommercial
- social pugOn-premWeb & CMS Plugins / site-builder

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Scored 5.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity NoneNo integrity impact
Availability NoneNo availability impact

Weaknesses

NVD-CWE-noinfoNo name in the record

Sources

References in the record

wpscan.com/vulnerability/1664697e-0ea3-4d09-b2fd-153a104ec255/

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Social Pug, not every advisory. This one: public exploit.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account