What is the CVSS score of CVE-2026-2515?

CVE-2026-2515 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Hostinger Reach WordPress Plugin CVE-2026-2515

EUVD-2026-29918 MEDIUM

Missing Authorization (CWE-862)

2026-05-13 Wordfence

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 10:00 vuln.today

CVE Published

May 13, 2026 - 08:26 nvd

MEDIUM 5.3

DescriptionCVE.org

The Hostinger Reach - AI-Powered Email Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_ajax_action' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to use the 'hostinger_reach_connection_notice_action' action to update the API key value stored in the database. This vulnerability can only be exploited when the plugin is not connected to a site and no API key value exists in the database.

AnalysisAI

Authenticated attackers with Subscriber-level access can modify the API key stored in the Hostinger Reach WordPress plugin (versions up to 1.3.8) due to missing capability checks in the AJAX handler, but only when the plugin is not yet connected to a site and the database contains no existing API key. The vulnerability allows unauthorized data modification via the 'hostinger_reach_connection_notice_action' action with CVSS 5.3 (network-accessible, high integrity impact, but requiring low-privilege authentication and non-standard conditions).

Technical ContextAI

The Hostinger Reach plugin for WordPress implements AJAX endpoints to handle plugin configuration actions. The vulnerability exists in the 'handle_ajax_action' function within the plugin's Admin/Notices/ConnectionNotice.php file (referenced in changeset 3473571). The root cause is CWE-862 (Missing Authorization / Capability Check) - the AJAX handler processes the 'hostinger_reach_connection_notice_action' without verifying WordPress user capabilities via functions like 'current_user_can()' before allowing database modifications. Authenticated WordPress users with Subscriber-level role (PR:L in CVSS) can trigger this endpoint. The attack surface is limited because the vulnerability is conditional: exploitation requires the plugin to be in an unconnected state with no pre-existing API key in the database, suggesting this is a post-installation or first-run configuration issue rather than an ongoing risk for active deployments.

RemediationAI

Update Hostinger Reach to version 1.3.9 or later, which should include capability checks on the AJAX handler. Immediate workarounds for administrators unable to patch immediately: (1) Restrict Subscriber-level user creation or access until the plugin is fully connected and an API key is stored - this eliminates the authenticated attacker prerequisite, though it requires custom user management; (2) Use WordPress security plugins or Web Application Firewalls to monitor and block AJAX requests to 'hostinger_reach_connection_notice_action' from low-privilege accounts before they reach the vulnerable code; (3) Ensure the plugin is immediately connected to the Hostinger service and an API key is configured during installation, which is the normal deployment flow and naturally prevents the vulnerable unconnected state. Verify the patch via the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/8d0fef4d-2c0e-486e-8a55-1c7230636a5c) and confirm the plugin version after update.