Pixelplay
Monthly
Unauthenticated attackers can delete administrator-configured third-party API keys (Pixabay, Unsplash, Pexels, and OpenAI) from WordPress sites running the PixelPlay plugin through version 1.0.2, by sending a request that sets the 'clear_api_type' parameter. The flaw is a missing authorization check (CWE-862) on an endpoint that should be restricted to privileged users, rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - a network-reachable, low-complexity attack with integrity-only impact and no data disclosure or code execution. No public exploit code has been identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); exploitation is only meaningful where an administrator has already stored API keys, and Wordfence is credited with the report.
Unauthenticated attackers can delete administrator-configured third-party API keys (Pixabay, Unsplash, Pexels, and OpenAI) from WordPress sites running the PixelPlay plugin through version 1.0.2, by sending a request that sets the 'clear_api_type' parameter. The flaw is a missing authorization check (CWE-862) on an endpoint that should be restricted to privileged users, rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - a network-reachable, low-complexity attack with integrity-only impact and no data disclosure or code execution. No public exploit code has been identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); exploitation is only meaningful where an administrator has already stored API keys, and Wordfence is credited with the report.