{"id":"CVE-2026-109191","kind":"vulnerability","aliases":["CVE-2026-109191"],"related":[],"title":"WordPress Image Hub plugin leaks third-party API keys to subscribers","description":"The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked page HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update_option().","summary":"The Image Hub WordPress plugin, up to and including 1.2.0, prints plaintext API credentials for Giphy, Openverse, Pexels, Pixabay and Unsplash into every admin page. A logged-in Subscriber can read those keys and also overwrite the stored credentials because the settings AJAX handler lacks a capability check.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-hub","package","self-hosted","wordpress"],"not_affected_if":["no-subscriber-registration","plugin-not-installed"],"how_to_check":"- Check the installed version of the Image Hub plugin in WordPress admin under Plugins; affected if it is `1.2.0` or older\n- Search admin page source for `image_hub_nonce` to confirm the keys are emitted in page HTML","fix":"- Update the Image Hub plugin to a version newer than `1.2.0` (unknown: the sources do not name the fixed version)\n- Rotate the Giphy, Openverse, Pexels, Pixabay and Unsplash API keys, since they may already have been read or overwritten","status":"open","published_at":"2026-10-16T05:17:28+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:41:18+00:00","updated_at":"2026-10-25T04:41:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:41:18Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Image Hub plugin to a version newer than `1.2.0` (unknown: the sources do not name the fixed version)\n- Rotate the Giphy, Openverse, Pexels, Pixabay and Unsplash API keys, since they may already have been read or overwritten","reach":"internet","title":"WordPress Image Hub plugin leaks third-party API keys to subscribers","impact":"medium","summary":"The Image Hub WordPress plugin, up to and including 1.2.0, prints plaintext API credentials for Giphy, Openverse, Pexels, Pixabay and Unsplash into every admin page. A logged-in Subscriber can read those keys and also overwrite the stored credentials because the settings AJAX handler lacks a capability check.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted","image-hub"],"confidence":0.8,"needs_auth":"yes","worst_case":"Subscriber reads and overwrites third-party API keys stored by the plugin","analyst_note":"Confirm the fixed plugin version from the WordPress.org plugin page or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-109191.","how_to_check":"- Check the installed version of the Image Hub plugin in WordPress admin under Plugins; affected if it is `1.2.0` or older\n- Search admin page source for `image_hub_nonce` to confirm the keys are emitted in page HTML","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-subscriber-registration"],"who_is_affected":"Sites running the Image Hub plugin at version 1.2.0 or older are exposed, and any site that lets users register with the Subscriber role is most at risk. Sites that do not have the plugin installed, or that restrict account registration, are not meaningfully exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000691,"input_tokens":3538,"output_tokens":674,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109191':15A,18A '-2026':14A,17A '1.2.0':36B,103C '6':110C 'absenc':178C 'access':124C 'admin':50B,153C 'ajax':70B,172C,189C 'allow':191C 'also':62B,165C 'api':9A,39B,108C,131C,203C 'attack':119C,197C 'authent':118C 'capabl':74B,181C 'check':75B,182C 'client':141C 'combin':175C 'contain':166C 'credenti':40B,66B,132C,204C 'cve':13A,16A 'emit':149C 'everi':49B,152C 'exposur':95C 'extract':128C 'free':79C 'giphi':42B,86C,139C 'handler':71B,190C 'host':25B 'html':156C,164C 'hub':3A,21B,29B,78C,107C,170C,186C 'id':142C 'imag':2A,20B,28B,77C,80C,106C,169C,185C 'image-hub':19B 'includ':35B,102C 'inform':94C 'key':10A,60B,109C 'lack':72B 'leak':5A,162C 'level':123C,196C 'local':159C 'log':54B 'logged-in':53B 'make':114C 'nonc':171C,173C 'openvers':43B,85C,140C 'option':111C,205C,208C 'overwrit':63B,199C 'packag':22B 'page':51B,154C,163C 'paramet':112C 'parti':8A,137C 'pexel':44B,84C,145C 'pixabay':45B,83C,146C 'plaintext':38B,130C 'plugin':4A,31B,87C 'possibl':116C 'print':37B 'read':58B 'script':160C 'secret':144C 'self':24B 'self-host':23B 'sensit':93C 'servic':138C 'set':69B,188C 'six':134C,201C 'store':65B,202C 'subscrib':12A,56B,122C,195C 'subscriber-level':121C,194C 'third':7A,136C 'third-parti':6A,135C 'unsplash':47B,82C,148C 'updat':187C,207C 'valid':168C 'verbatim':150C 'version':98C 'via':104C,157C,206C 'vulner':91C 'wordpress':1A,26B,30B,89C 'wp':158C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Image Hub plugin at version 1.2.0 or older are exposed, and any site that lets users register with the Subscriber role is most at risk. Sites that do not have the plugin installed, or that restrict account registration, are not meaningfully exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T05:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109191","severity":null,"published_at":"2026-10-16T05:17:28+00:00","modified_at":"2026-10-16T15:17:06+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}