Live › vulnerability › CVE-2026-109191
Go to dashboardThe Image Hub WordPress plugin, up to and including 1.2.0, prints plaintext API credentials for Giphy, Openverse, Pexels, Pixabay and Unsplash into every admin page. A logged-in Subscriber can read those keys and also overwrite the stored credentials because the settings AJAX handler lacks a capability check.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Image Hub plugin at version 1.2.0 or older are exposed, and any site that lets users register with the Subscriber role is most at risk. Sites that do not have the plugin installed, or that restrict account registration, are not meaningfully exposed.
No product ranges from the sources yet.
1.2.0 or olderimage_hub_nonce to confirm the keys are emitted in page HTML1.2.0 (unknown: the sources do not name the fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked page HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update_option().
This page as .md · .json · in your agent: get_signal("CVE-2026-109191")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.