Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML
Strategic Overview
- Status
- Patched in 1.3.0
- Affected Version
<= 1.2.0- CVSS
- 4.3Medium
- Weakness type
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- CVE
CVE-2026-109191
At a glance
CVE-2026-109191 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the Image Hub WordPress plugin, affecting versions <= 1.2.0. It carries a CVSS score of 4.3 (reachable over the network; low attack complexity). Exploitation requires an authenticated account at Subscriber level or above. The issue is fixed in version 1.3.0; sites on affected versions should update now. Disclosed October 2026, reported by crow.
Vulnerability Overview
The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked page HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update_option().
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Image Hub <= 1.2.0 carries this weakness at update_option(), and reaching it takes an account at Subscriber level or above. Sensitive information exposure means data the application intended to keep internal is returned to a caller who should not be able to see it.
The disclosed data — credentials, tokens, customer records or internal paths — is usually worth more as material for a follow-up attack than as an end in itself. For Image Hub the fix is 1.3.0: builds <= 1.2.0 are affected, anything from 1.3.0 onward is not.
Remediation
Update to version 1.3.0, or a newer patched version
How does WordSec protect against this?
The fix is the thing that ends this: Image Hub 1.3.0 closes this, and updating the plugin is the step that ends it.
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C