# Hostinger Reach <= 1.8.9 - Authenticated (Author+) Insecure Direct Object Reference to Reach Form Modification via 'formId' Block Attribute

- **ID:** WPSEC-2026-2857
- **Plugin:** Hostinger Reach – AI-Powered Email Marketing for WordPress (`hostinger-reach`), https://wordpress.org/plugins/hostinger-reach/
- **Affected versions:** all versions before 1.8.10
- **Fixed in:** 1.8.10 (Update to 1.8.10 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/hostinger-reach
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2857/

## Description

The Hostinger Reach plugin for WordPress is vulnerable to Insecure Direct Object Reference via the Reach subscription block's 'formId' attribute in all versions up to, and including, 1.8.9. This is due to the form sync that runs when a post is published updating any existing form record whose ID matches the block's formId, after checking only the record's type and not whether the form belongs to the post being published. This makes it possible for authenticated attackers, with Author-level access and above, to put another post's form ID (for example, a form on a page an administrator created) into a block in their own post and publish it. This overwrites that form's record, including the contact list that its subscribers are added to.

## References

- https://wpsec.com/vuln/WPSEC-2026-2857/
- https://plugins.svn.wordpress.org/hostinger-reach/tags/1.8.10/
- https://wordpress.org/plugins/hostinger-reach/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2857/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.