CVE-2026-2515

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Hostinger Reach – AI-Powered Email Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_ajax_action' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to use the 'hostinger_reach_connection_notice_action' action to update the API key value stored in the database. This vulnerability can only be exploited when the plugin is not connected to a site and no API key value exists in the database.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-2515010.0Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() f CVE-2026-251515.9Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interpre CVE-2026-251526.5Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities f CVE-2026-251538.8Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities f CVE-2026-251546.1LocalSend is a free, open-source app that allows users to share files and messages with nearby devices over their local network without need CVE-2026-251557.1Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes in CVE-2026-251566.3HotCRP is conference review software. HotCRP versions from October 2025 through January 2026 delivered documents of all types with inline Co CVE-2026-251577.5OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in CVE-2026-25167.0A vulnerability was identified in Unidocs ezPDF DRM Reader and ezPDF Reader 2.0/3.0.0.4. This affects an unknown part in the library SHFOLDE CVE-2026-251607.4Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables CVE-2026-251618.8Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application contains CVE-2026-251648.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the REST AP