Image Hub EUVD-2026-102645

Exploitation requires an authenticated account with Subscriber-level capability or higher (PR:L) on a site running Image Hub for WordPress version ≤1.2.0, and the attacker must be able to load an admin-area page where the plugin emits its settings via wp_localize_script. The key LIMITING factors: an account is required (so sites that disable open registration and tightly control low-privilege users substantially reduce exposure), and the impact is confined to third-party image-service API credentials - leaking them (information disclosure) and, via the capability-check-missing image_hub_update_settings AJAX handler reachable with the leaked image_hub_nonce, overwriting them. No default-configuration unauthenticated path exists; the flaw is not exploitable by fully anonymous visitors.

This is a moderate, authenticated information-disclosure flaw that is realistically a medium-priority patch item, not an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) indicates network-reachable, low-complexity exploitation requiring only Subscriber-level authentication and no user interaction - a low bar on any site that allows user registration. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was supplied, so under the precision rules this is 'no public exploit identified at time of analysis'; the only intelligence source is the Wordfence advisory. IMPORTANT CONFLICT: the official vector sets I:N, but the description explicitly states the Subscriber can overwrite all six stored API-credential options via an unauthenticated-capability-check update_settings AJAX handler using a leaked nonce - that is a clear integrity impact the scored vector understates (see assessed vectors below). The true severity is therefore somewhat higher than the 4.3 base implies, but it remains gated behind authentication and the practical blast radius is limited to leaking/overwriting third-party image-service API keys rather than compromising the WordPress host itself.

An attacker registers (or abuses an existing) Subscriber-level account on a WordPress site running Image Hub ≤1.2.0, then loads any admin page whose HTML embeds the plaintext Giphy/Openverse/Pexels/Pixabay/Unsplash API credentials and a valid image_hub_nonce via wp_localize_script. Using that leaked nonce against the image_hub_update_settings AJAX endpoint, which performs no capability check, the same low-privilege user can also overwrite all six stored credentials. No public exploit code was identified, but exploitation is straightforward given the low complexity and well-documented source references.