CVE-2026-109191: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in extendthemes Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy

CVE-2026-109191 describes a sensitive information exposure vulnerability in the Image Hub plugin for WordPress, affecting all versions up to and including 1.2.0. Authenticated users with subscriber-level privileges can extract plaintext API keys for Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash from admin page HTML. The plugin emits these keys via wp_localize_script without restriction. Furthermore, the presence of a valid image_hub_nonce AJAX nonce combined with the absence of capability checks in the image_hub_update_settings AJAX handler enables these users to overwrite all six API credential options via update_option(), potentially compromising the integrity of the plugin's configuration.

An attacker with subscriber-level access can obtain sensitive API credentials for multiple third-party services, which could be used to abuse those services or compromise integrations. The attacker can also overwrite these credentials due to missing authorization checks, potentially disrupting service or injecting malicious keys. The vulnerability does not directly impact confidentiality beyond the API keys, nor does it affect integrity or availability of the WordPress site beyond the plugin's settings.

No official patch or fix is currently confirmed. Users should check the vendor advisory for updates. Until a fix is available, restrict subscriber-level access to trusted users only. Monitor for plugin updates addressing this issue and apply them promptly once released.