CVE-2026-2515: Hostinger Reach Auth Bypass Vulnerability

CVE-2026-2515 Overview

CVE-2026-2515 is a missing authorization vulnerability in the Hostinger Reach – AI-Powered Email Marketing for WordPress plugin. The flaw affects all versions up to and including 1.3.8. The handle_ajax_action function lacks a capability check, allowing authenticated users with Subscriber-level access or higher to invoke the hostinger_reach_connection_notice_action action. Successful exploitation lets attackers write an attacker-controlled API key value into the database. Exploitation requires the plugin to be disconnected from a site, with no existing API key value stored. The weakness is categorized as [CWE-862] Missing Authorization.

Critical Impact
Authenticated Subscriber-level users can write an arbitrary API key into the WordPress database, enabling integrity compromise of the plugin's email marketing connection.

Affected Products

Hostinger Reach – AI-Powered Email Marketing for WordPress plugin
All versions up to and including 1.3.8
WordPress sites where the plugin is installed but not yet connected

Discovery Timeline

2026-05-13 - CVE-2026-2515 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-2515

Vulnerability Analysis

The Hostinger Reach plugin exposes an AJAX action handler named handle_ajax_action that processes the hostinger_reach_connection_notice_action request. The handler does not verify the requesting user's capabilities before writing to plugin options. Because WordPress treats any authenticated user, including the lowest-privilege Subscriber role, as a valid actor for the AJAX endpoint, attackers with minimal access can trigger sensitive functionality. The endpoint updates the stored API key when no key currently exists, allowing an attacker to seed the plugin with credentials they control.

Root Cause

The root cause is the absence of a current_user_can() capability check inside the AJAX handler. The plugin relies on authentication alone rather than authorization, conflating "logged in" with "authorized to administer plugin settings." This is a textbook [CWE-862] Missing Authorization defect. See the WordPress Plugin Code Review and WordPress Plugin Route Code for the affected logic.

Attack Vector

An attacker first obtains Subscriber-level access through standard registration on sites that permit it. The attacker then sends an authenticated request to the WordPress AJAX endpoint invoking the hostinger_reach_connection_notice_action action with a crafted API key parameter. If the plugin is in its initial unconnected state, the handler persists the attacker's key. The plugin will subsequently route email marketing operations through the attacker-controlled Hostinger Reach account.

No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-2515

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing the action parameter hostinger_reach_connection_notice_action from low-privilege user sessions
Unexpected modification of the hostinger_reach API key option in the wp_options table
New Subscriber accounts created shortly before AJAX requests to the Hostinger Reach action
Outbound API traffic from the WordPress host to Hostinger Reach endpoints using an unrecognized key

Detection Strategies

Audit WordPress access logs for admin-ajax.php requests referencing hostinger_reach_connection_notice_action originating from non-administrator sessions
Compare the stored API key option value against the value provisioned by the site owner, alerting on any change
Correlate user role with AJAX action invocations to surface Subscriber accounts touching administrative actions

Monitoring Recommendations

Enable WordPress audit logging plugins to record option changes and AJAX action calls with the originating user ID
Forward web server and PHP logs to a centralized SIEM for query-based identification of suspicious AJAX patterns
Monitor user registration spikes on sites that allow open registration, correlating them with plugin configuration changes

How to Mitigate CVE-2026-2515

Immediate Actions Required

Update the Hostinger Reach plugin to a version newer than 1.3.8 that includes the fix referenced in the WordPress Plugin Changeset Update
If the plugin is installed but not connected, complete the legitimate connection flow promptly to populate the API key and close the exploitable window
Review existing API key values stored by the plugin and rotate any key that cannot be verified as administrator-provisioned
Audit WordPress user accounts and remove unused Subscriber registrations

Patch Information

The vendor addressed the vulnerability in the changeset referenced at WordPress Plugin Changeset Update. Site operators should upgrade to the fixed release through the WordPress plugin dashboard or by deploying the updated plugin package. Verify the installed version is greater than 1.3.8 after upgrading.

Workarounds

Disable open user registration, or restrict the default role so that untrusted accounts cannot authenticate
Deactivate the Hostinger Reach plugin until the patched version is deployed
Restrict access to /wp-admin/admin-ajax.php for the hostinger_reach_connection_notice_action action using a web application firewall rule

bash

# Example WAF rule snippet to block the vulnerable AJAX action for non-admins
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:2026251501,msg:'Block Hostinger Reach connection notice action'"
  SecRule ARGS:action "@streq hostinger_reach_connection_notice_action"