Hostinger Reach <= 1.8.9 - Authenticated (Author+) Insecure Direct Object Reference to Reach Form Modification via 'formId' Block Attribute
- ID
- WPSEC-2026-2857
- Plugin
- Hostinger Reach – AI-Powered Email Marketing for WordPress (hostinger-reach)
- Affected
- all versions before 1.8.10
- Remediation
- Update to 1.8.10 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Hostinger Reach on WPSec AttackSurface
- Fix released
- Published
Description
The Hostinger Reach plugin for WordPress is vulnerable to Insecure Direct Object Reference via the Reach subscription block's 'formId' attribute in all versions up to, and including, 1.8.9. This is due to the form sync that runs when a post is published updating any existing form record whose ID matches the block's formId, after checking only the record's type and not whether the form belongs to the post being published. This makes it possible for authenticated attackers, with Author-level access and above, to put another post's form ID (for example, a form on a page an administrator created) into a block in their own post and publish it. This overwrites that form's record, including the contact list that its subscribers are added to.
References
- https://wpsec.com/vuln/WPSEC-2026-2857/
- https://plugins.svn.wordpress.org/hostinger-reach/tags/1.8.10/
- https://wordpress.org/plugins/hostinger-reach/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS