HubSpot ships July 10 security updates for its WordPress plugin after CVE‑2026‑57736
On July 10, 2026, HubSpot released new builds of its All‑In‑One Marketing WordPress plugin that complete the fix for CVE‑2026‑57736 by removing the legacy refresh‑token endpoint and tightening token handling. The updates follow a July 9 security advisory confirming the move of OAuth token exchange to the server, closing an exposure path that could reveal refresh tokens to lower‑privileged WordPress users.
HubSpot hardens WordPress plugin with July 10 build removing legacy endpoint
The WordPress.org plugin changelog shows version 11.3.62 landed on July 9 to migrate the OAuth flow to the v2 token‑exchange endpoint, followed by builds 11.3.64 and 11.3.65 on July 10 that remove the deprecated refresh‑token route and finalize the patching sequence. Those releases are now live on the WordPress.org plugin changelog.
CVE‑2026‑57736 exposed refresh tokens; patch shifts OAuth fully server‑side
HubSpot updated its Trust Center on July 9 to outline the issue and remediation timeline: versions up to 11.3.53 could expose a portal’s OAuth refresh token to contributor‑level users in certain conditions; an initial mitigation shipped July 6, and a root‑cause fix on July 8 (11.3.61) moved all token exchanges server‑side with no evidence of in‑the‑wild exploitation reported. Details are captured in the HubSpot Trust Center advisory.
Vulnerability record confirms sensitive data exposure in affected versions
The CVE entry classifies the weakness as insertion of sensitive information into sent data and lists affected versions through 11.3.51, aligning with HubSpot’s advisory and the rapid sequence of plugin patches. The record is public in the NVD listing for CVE‑2026‑57736.
What site owners running HubSpot’s plugin should do now
If your WordPress site connects to HubSpot through the plugin, the fastest practical steps are:
- Update to 11.3.65 or later today from your WordPress dashboard to pick up the endpoint removal and token‑flow changes. In practice, this prevents refresh tokens from ever touching the browser layer.
- Rotate connected‑app credentials if your site previously ran a vulnerable version and multiple contributor‑level accounts had admin access to the plugin settings.
- Review recent admin activity and server logs for anomalous token or settings access around late June to early July; a common issue is assuming plugin auto‑updates were enabled when they were not.
- Re‑test key forms, pop‑ups, and chat after updating. One limitation with security hardening is that older custom code occasionally assumed now‑removed endpoints.
Version timeline that matters to security teams
- July 6: mitigation removes refresh token from inline script (11.3.58), per HubSpot’s advisory.
- July 8: root‑cause fix moves token exchange server‑side (11.3.61) with guidance to update.
- July 9: OAuth flow migrates to v2 endpoint (11.3.62), per the plugin changelog.
- July 10: cleanup builds (11.3.64 and 11.3.65) remove the deprecated endpoint to prevent fallback behavior seen in some environments; confirmation in the HubSpot Trust Center advisory.
Share With Others
Platinum
