CVE-2026-109191: Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML

Q: Who can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker does not need administrative privileges or user interaction.

Q: What information and changes can an attacker obtain or make?

An attacker can extract plaintext API credentials for Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash from admin-page HTML. Using the exposed image_hub_nonce and the unrestricted settings AJAX handler, they can also overwrite all six stored API credential options.

Q: Are installations using the affected plugin configuration exposed by default?

The credentials and nonce are emitted into every admin page's HTML, and the AJAX handler lacks a capability check. Exposure applies when an authenticated Subscriber-level or higher account can access the WordPress administration area.

Q: How can I determine whether my site is affected?

Check whether the Image Hub plugin is installed at version 1.2.0 or earlier. On an affected installation, inspect admin-page HTML for the image_hub_api_keys options and image_hub_nonce, and review the configured third-party API credentials for unexpected changes.

Published Oct 16, 2026

Updated

The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'imagehubapikeys (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wplocalizescript. The leaked page HTML also contains a valid imagehubnonce AJAX nonce, which — combined with the absence of any capability check in the imagehubupdatesettings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via updateoption().

Affected Software

1 affected component

Image Hub Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy<=1.2.0

Event History

Oct 16, 2026

CVE Published

via MITRE·04:27 AM

Data Sourced

via MITRE·04:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker does not need administrative privileges or user interaction.

What information and changes can an attacker obtain or make?

An attacker can extract plaintext API credentials for Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash from admin-page HTML. Using the exposed image_hub_nonce and the unrestricted settings AJAX handler, they can also overwrite all six stored API credential options.

Are installations using the affected plugin configuration exposed by default?

The credentials and nonce are emitted into every admin page's HTML, and the AJAX handler lacks a capability check. Exposure applies when an authenticated Subscriber-level or higher account can access the WordPress administration area.

How can I determine whether my site is affected?

Check whether the Image Hub plugin is installed at version 1.2.0 or earlier. On an affected installation, inspect admin-page HTML for the image_hub_api_keys options and image_hub_nonce, and review the configured third-party API credentials for unexpected changes.

CVE-2026-109191: Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information and changes can an attacker obtain or make?

Are installations using the affected plugin configuration exposed by default?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information and changes can an attacker obtain or make?

Are installations using the affected plugin configuration exposed by default?

How can I determine whether my site is affected?