Technical impact
The Hostinger Reach – AI‑Powered Email Marketing for WordPress plugin for WordPress is vulnerable to an unauthorized modification of data due to a missing capability check on the 'handle_ajax_action' function. In all versions up to and including 1.3.8, an authenticated attacker who has Subscriber‑level access and above can trigger the 'hostinger_reach_connection_notice_action' action to update the API key value stored in the database. This change allows the attacker to set an arbitrary API key, which may enable further exploitation of the email marketing integration or compromise communications. The vulnerability provides a direct path for credential or configuration manipulation, and could allow attackers to use their own key to access or alter email campaign data.
Affected Systems
Hostinger Reach – AI‑Powered Email Marketing for WordPress plugin, versions up to and including 1.3.8, which are installed on WordPress sites hosted by hosts leveraging the Hostinger Reach package.
Risk and Exploitability
The vulnerability carries a CVSS score of 5.3, indicating moderate severity. Although no EPSS information is available, the lack of a randomly exploitable vector and the requirement for an authenticated user with Subscriber-level permissions limit the risk. The vulnerability is not listed in the CISA KEV catalog. Exploitation occurs via an AJAX endpoint when the plugin is unconnected and no API key has yet been stored; therefore the window of opportunity is narrow, but the potential impact on configuration integrity is significant.
