Hostinger Reach < 1.3.9 - Subscriber+ Arbitrary API Key Update

Description

The plugin is vulnerable to unauthorized modification of data due to a missing capability check on the `handle_ajax_action` function, allowing authenticated attackers with Subscriber-level access and above to use the `hostinger_reach_connection_notice_action` action to update the API key value stored in the database. The vulnerability can only be exploited when the plugin is not connected to a site and no API key value exists in the database.