{
 "id": "WPSEC-2026-2901",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2901/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2901/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2901/index.md",
 "title": "Hostinger <= 3.0.81 - Unauthenticated Sensitive Information Exposure via REST API and llms.txt in Maintenance Mode",
 "description": "The Hostinger Tools plugin for WordPress is vulnerable to Sensitive Information Exposure via the WordPress REST API and the generated llms.txt file in all versions up to, and including, 3.0.81, due to the maintenance (coming soon) mode only replacing front-end page requests on the template_redirect hook, without restricting REST API requests or removing the llms.txt file. This makes it possible for unauthenticated attackers to read site content the owner intended to hide while maintenance mode is on, such as posts, pages, user listings, oEmbed data and WooCommerce Store API data, through the wp/v2, oembed/1.0 and wc/store REST namespaces or the llms.txt file. Maintenance mode must be enabled.",
 "plugin": {
  "slug": "hostinger",
  "name": "Hostinger",
  "full_name": "Hostinger Tools",
  "wordpress_org": "https://wordpress.org/plugins/hostinger/",
  "advisories_url": "https://wpsec.com/vuln/plugin/hostinger/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/hostinger"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.0.82",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.0.82"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.0.82",
 "remediation": "Update to 3.0.82 or later.",
 "fix_released": "2026-11-10T12:39:53+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:08:50.327078+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2901/",
  "https://plugins.svn.wordpress.org/hostinger/tags/3.0.82/",
  "https://wordpress.org/plugins/hostinger/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/hostinger",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}