Image Buzz EUVD-2025-210982

No special conditions - remote unauthenticated exploitation against default configurations of the Image Buzz WordPress plugin (versions up to and including 1.0.3). The only functional prerequisite is that an administrator has installed the plugin; the vulnerable settings-update path lacks any capability or nonce check, so no login, user interaction, or non-default setting is required. Impact is inherently limited to modifying the Pixabay/Unsplash/Pexels API key configuration values - there is no confidentiality or availability impact and no path to code execution from this flaw alone.

This is a genuine but low-severity issue. All exploitation signals point the same direction: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, which agrees with the CWE-862 missing-authorization root cause and the description. However, the impact ceiling is deliberately low: only Integrity is affected (I:L), with no confidentiality or availability impact - the attacker can overwrite the stock-image API keys (Pixabay, Unsplash, Pexels) an admin configured, but cannot read data, execute code, or take over the site. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active or automated exploitation. The realistic worst case is nuisance/abuse: swapping in attacker-controlled keys to hijack or exhaust the admin's third-party API quota, or breaking image functionality. This is a real-priority-only-in-context finding, not a widespread emergency - the low prevalence of the plugin further reduces aggregate risk. No signals conflict; the vector and description are consistent.

An unauthenticated attacker sends a crafted request to the plugin's unprotected settings-handling endpoint on a site running Image Buzz <=1.0.3, supplying the 'pixabay_api', 'unsplash_api', or 'pixels_api' parameters. Because no authorization check gates the update, the admin's configured stock-image API keys are silently overwritten with attacker-chosen values, letting the attacker hijack or exhaust the site's third-party image API usage. No public proof-of-concept exploit was identified in the provided data.