Image Hub Free Images From Unsplash Pixabay Pexels Openverse Giphy
Monthly
Subscriber-level users on WordPress sites running Image Hub 1.2.0 and earlier can extract six third-party image-service API credentials from admin-page HTML and then use an exposed AJAX nonce to overwrite those stored credentials. The plugin emits Giphy, Openverse, Pexels, Pixabay, and Unsplash key options via wp_localize_script, and the image_hub_update_settings AJAX handler lacks a capability check, allowing the same low-privilege attacker to modify settings through update_option(). No public exploit identified at time of analysis; the assessed risk is a moderate, patch-priority information-disclosure and integrity issue rather than an emergency.
Subscriber-level users on WordPress sites running Image Hub 1.2.0 and earlier can extract six third-party image-service API credentials from admin-page HTML and then use an exposed AJAX nonce to overwrite those stored credentials. The plugin emits Giphy, Openverse, Pexels, Pixabay, and Unsplash key options via wp_localize_script, and the image_hub_update_settings AJAX handler lacks a capability check, allowing the same low-privilege attacker to modify settings through update_option(). No public exploit identified at time of analysis; the assessed risk is a moderate, patch-priority information-disclosure and integrity issue rather than an emergency.