CVE-2026-2515 is a missing authorization vulnerability (CWE-862) in the Hostinger Reach WordPress plugin affecting all versions up to 1.3.8. The issue arises because the 'handle_ajax_action' function does not perform a capability check, allowing authenticated users with low privileges (Subscriber-level and above) to modify the API key in the database using a specific AJAX action. This vulnerability can only be exploited if the plugin is not connected to a site and no API key is present, limiting the attack scope. No official patch or remediation guidance is currently available.

An attacker with Subscriber-level access or higher can update the API key value in the database, potentially leading to unauthorized modification of plugin configuration. This could affect the integrity of the plugin's connection to the email marketing service. There is no indication of confidentiality or availability impact. Exploitation requires the plugin to be disconnected and lacking an API key, which reduces the likelihood and scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and ensure the plugin is properly connected with an API key to prevent exploitation. Monitor for plugin updates addressing this vulnerability.