Hostinger Reach <= 1.8.7 - Unauthenticated Missing Authorization to Contact Group Manipulation via OptinMonster Submission Endpoint
- ID
- WPSEC-2026-2568
- Plugin
- Hostinger Reach – AI-Powered Email Marketing for WordPress (hostinger-reach)
- Affected
- from 1.3.6 before 1.8.8
- Remediation
- Update to 1.8.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-05
- Attack surface
- Hostinger Reach on WPSec AttackSurface
- Fix released
- Published
Description
The Hostinger Reach plugin for WordPress is vulnerable to unauthorized modification of data via the OptinMonster submission REST endpoint (hostinger-reach/v1/optinmonster) in all versions up to, and including, 1.8.7, due to the form enabled check being skipped when the submitted form ID does not match a known form, and the contact group being built from request-supplied campaign and form name values. This makes it possible for unauthenticated attackers to add contacts to the site's connected Hostinger Reach account under arbitrary group names, creating new tags, and to bypass a form's disabled setting, when the OptinMonster integration is active.
References
- https://wpsec.com/vuln/WPSEC-2026-2568/
- https://plugins.svn.wordpress.org/hostinger-reach/tags/1.8.8/
- https://wordpress.org/plugins/hostinger-reach/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS