EUVD-2025-210981
GHSA-jrhq-q5jc-pgv2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site over network
-
DeliverySend request with clear_api_type parameter
-
ExploitMissing authorization check passes
-
ExecutionPlugin deletes configured API key
-
ImpactSite integrations disrupted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the PixelPlay WordPress plugin (versions up to and including 1.0.2), reachable over the network with no authentication or user interaction. The only practical prerequisite is that a site administrator has previously configured one or more API keys (Pixabay, Unsplash, Pexels, or OpenAI) for the attacker to delete; if no keys are configured, the action has no effect. Impact is limited to integrity - deletion of these integration keys - with no data disclosure or code execution. |
| Impact | The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) is internally consistent with the description: a fully network-reachable, low-complexity, unauthenticated request (PR:N/UI:N) that produces a bounded integrity-only impact (I:L) - deletion of administrator-configured third-party API keys (Pixabay, Unsplash, Pexels, OpenAI) with no confidentiality (C:N) or direct availability (A:N) loss. No EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation signals are absent; per available data this is 'no public exploit identified at time of analysis.' Realistically this is a genuine unauthenticated missing-authorization flaw (CWE-862) but a low-priority one: the attacker gains no data and no code execution - the effect is a nuisance/denial of a plugin integration (broken image search or AI features until an admin re-enters keys), potentially causing paid-API disruption. The single conflicting signal is metadata, not scoring: the 'Authentication Bypass' tag misdescribes the root cause, which is missing authorization on an already-unauthenticated endpoint, not a bypass of an auth mechanism. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the PixelPlay plugin's API-key handler with the 'clear_api_type' parameter set to a target service, and the missing authorization check causes the plugin to delete that stored key. Repeating this for Pixabay, Unsplash, Pexels, and OpenAI wipes all configured integrations, breaking the site's image/AI features until an administrator manually re-enters them. No public exploit code is identified, but the attack is trivial given AV:N/AC:L/PR:N/UI:N. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Unauthenticated attackers can delete administrator-configured third-party API keys (Pixabay, Unsplash, Pexels, and OpenAI) from WordPress sites running the PixelPlay plugin through version 1.0.2, by sending a request that sets the 'clear_api_type' parameter. The flaw is a missing authorization check (CWE-862) on an endpoint that should be restricted to privileged users, rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - a network-reachable, low-complexity attack with integrity-only impact and no data disclosure or code execution. No public exploit code has been identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); exploitation is only meaningful where an administrator has already stored API keys, and Wordfence is credited with the report.
RemediationAI
No vendor-released patch has been identified at time of analysis, so the primary action is to check the plugin's Envato/CodeCanyon item page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/20589c53-56ff-41ba-857d-40b947a0e55c?source=cve) for an updated release and upgrade to the first version beyond 1.0.2 once it ships; the affected range is confirmed open-ended up to and including 1.0.2. Until then, the most effective compensating control is to deactivate and remove the PixelPlay plugin on sites that do not need it - a definitive fix at the cost of losing its video-autoplay functionality. If the plugin must stay, deploy a WAF or reverse-proxy rule that blocks external requests carrying the 'clear_api_type' parameter (particularly POST/GET to admin-ajax.php and any plugin REST route) while leaving legitimate authenticated admin traffic intact; the trade-off is potential false positives if the plugin's own admin UI reuses the same parameter, in which case an allow-list by authenticated session is required. Because the impact is limited to credential deletion rather than disclosure, also keep an offline backup of the configured Pixabay, Unsplash, Pexels, and OpenAI keys so they can be re-entered quickly, and monitor those integrations for unexpected authentication failures that would indicate a key was wiped. Restricting access to wp-admin and admin-ajax.php by IP or requiring HTTP authentication at the web-server layer reduces exposure but can break legitimate front-end AJAX features, so validate before enforcing broadly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PixelPlay is a commercial Envato/CodeCanyon video-autoplay plugin for WordPress (vendor namespace 'kamleshyadav', CPE cpe:2.3:a:kamleshyadav:pixelplay:*:*:*:*:*:*:*:*). The root cause is classed as CWE-862 Missing Authorization: the plugin exposes an action that accepts a 'clear_api_type' parameter and removes stored integration credentials, but the handler does not perform a capability check (e.g., current_user_can('manage_options')) or nonce validation before acting. Because WordPress dispatches such handlers through admin-ajax.php-style entry points, an unauthenticated request can reach the deletion logic directly - the same class of bug that occurs when developers register a handler for unauthenticated requests (wp_ajax_nopriv) or omit the permission callback on a REST route. The affected state is not the plugin's own data but the third-party service credentials kept in the site's options, which the plugin uses to sign calls to the Pixabay, Unsplash, Pexels, and OpenAI APIs. Only the integrity of those stored keys is affected (I:L); there is no confidentiality, availability, or scope impact, consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Know when Pixelplay gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable, low-complexity, unauthenticated endpoint with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is limited deletion of stored config values (I:L) with no disclosure or availability loss.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys (Pixabay, Unsplash, Pixels, OpenAI) configured by site administrators via the 'clear_api_type' parameter.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB