Hostinger Reach WordPress Plugin CVE-2026-2515

Exploitation requires: (1) Authenticated access to WordPress as a user with at least Subscriber-level role (minimum PR:L in CVSS); (2) The Hostinger Reach plugin must be installed and activated on the target WordPress site; (3) The plugin must NOT be connected to a Hostinger account - meaning no valid API key is stored in the database (wp_options table). These conditions are explicitly stated in the CVE description as 'when the plugin is not connected to a site and no API key value exists in the database.' Once an API key is configured during normal plugin setup, the vulnerability cannot be exploited. The attack is constrained to initial plugin configuration or if an administrator manually disconnects the plugin. Limitations: attackers cannot exploit fully configured instances, require legitimate user account creation (not anonymous access), and cannot escalate beyond modifying the stored API key value itself.

CVSS 5.3 with AV:N/AC:H/PR:L indicates moderate but constrained risk. The network vector and lack of user interaction requirement are offset by three significant limiting factors: (1) attackers must be authenticated with at least Subscriber-level WordPress access, eliminating anonymous exploitation; (2) AC:H (high complexity) reflects the non-default condition requirement - the plugin must not be connected and must have no existing API key, meaning this primarily affects fresh installations or disconnected instances; (3) integrity impact (I:H) is real but scoped to the API key value, not arbitrary code execution. The absence of EPSS score, KEV listing, or confirmed POC in the provided data suggests this is not actively exploited in the wild despite being publicly documented via WordPress plugin repository. Risk priority depends on deployment context: new Hostinger Reach installations with open Subscriber access are vulnerable, but mature deployments with the plugin already connected are unlikely to encounter this. This is a real vulnerability but lower risk than the CVSS score alone suggests due to conditional exploitation requirements and authentication barrier.

An attacker with a legitimate low-privilege WordPress Subscriber account (or who has registered as one on a site with open registration) logs in after a fresh installation of Hostinger Reach when the site administrator has not yet connected the plugin to Hostinger services. The attacker uses browser developer tools or a custom script to send an AJAX POST request to the 'hostinger_reach_connection_notice_action' endpoint with a malicious API key value. Because the plugin lacks capability checks, the request is processed and the attacker's API key is stored in the WordPress options table, effectively hijacking the plugin's authentication for email marketing campaigns.