# Hostinger Reach <= 1.8.7 - Unauthenticated Missing Authorization to Contact Group Manipulation via OptinMonster Submission Endpoint

- **ID:** WPSEC-2026-2568
- **Plugin:** Hostinger Reach – AI-Powered Email Marketing for WordPress (`hostinger-reach`), https://wordpress.org/plugins/hostinger-reach/
- **Affected versions:** from 1.3.6 before 1.8.8
- **Fixed in:** 1.8.8 (Update to 1.8.8 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/hostinger-reach
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2568/

## Description

The Hostinger Reach plugin for WordPress is vulnerable to unauthorized modification of data via the OptinMonster submission REST endpoint (hostinger-reach/v1/optinmonster) in all versions up to, and including, 1.8.7, due to the form enabled check being skipped when the submitted form ID does not match a known form, and the contact group being built from request-supplied campaign and form name values. This makes it possible for unauthenticated attackers to add contacts to the site's connected Hostinger Reach account under arbitrary group names, creating new tags, and to bypass a form's disabled setting, when the OptinMonster integration is active.

## References

- https://wpsec.com/vuln/WPSEC-2026-2568/
- https://plugins.svn.wordpress.org/hostinger-reach/tags/1.8.8/
- https://wordpress.org/plugins/hostinger-reach/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2568/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.