Hostinger Reach <= 1.8.7 - Unauthenticated Missing Authorization to Arbitrary Contact List and Tag Assignment via Form Submission
- ID
- WPSEC-2026-2569
- Plugin
- Hostinger Reach – AI-Powered Email Marketing for WordPress (hostinger-reach)
- Affected
- all versions before 1.8.8
- Remediation
- Update to 1.8.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-05
- Attack surface
- Hostinger Reach on WPSec AttackSurface
- Fix released
- Published
Description
The Hostinger Reach plugin for WordPress is vulnerable to unauthorized modification of data via the public contact form submission REST endpoint (hostinger-reach/v1/contact) in all versions up to, and including, 1.8.7, due to the contact list (group), tags and metadata being taken directly from request parameters and the submitted form ID not being checked to exist or be active. This makes it possible for unauthenticated attackers to add arbitrary email addresses to any existing contact list and tag in the site's connected Hostinger Reach account, including through disabled forms or when no form is published.
References
- https://wpsec.com/vuln/WPSEC-2026-2569/
- https://plugins.svn.wordpress.org/hostinger-reach/tags/1.8.8/
- https://wordpress.org/plugins/hostinger-reach/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS