CVE-2026-109191
Received Received - Intake

Sensitive Information Exposure in Image Hub WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked page HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update_option().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-109191
EUVD
EUVD-2026-102645

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
extendthemes Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Image Hub WordPress plugin up to version 1.2.0 exposes sensitive API credentials for six third-party services (Giphy, Openverse, Pexels, Pixabay, Unsplash) in plaintext. Authenticated attackers with subscriber-level access can view these credentials in admin page HTML and use a valid nonce to overwrite them via an unprotected AJAX handler.

Detection Guidance

Check WordPress admin pages for exposed API keys in HTML source. Look for plaintext credentials in parameters like image_hub_api_keys_* (Giphy, Openverse, Pexels, Pixabay, Unsplash). Use browser developer tools to inspect page source for these values.

Impact Analysis

Attackers could misuse exposed API keys to make unauthorized requests, potentially consuming service quotas, modifying content, or accessing restricted data. Compromised credentials may also lead to further account breaches or service disruptions.

Mitigation Strategies

Update the Image Hub plugin to the latest version if available. Rotate all exposed API keys for Giphy, Openverse, Pexels, Pixabay, and Unsplash immediately. Remove the plugin if unused. Check for unauthorized settings changes via update_option().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109191. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart