extendthemes Image Hub Plugin up to 1.2.0 on WordPress image_hub_update_settings AJAX handler update_option image_hub_api_keys_* missing encryption

Summaryinfo

A vulnerability classified as problematic has been found in extendthemes Image Hub Plugin up to 1.2.0. This vulnerability affects the function update_option of the component image_hub_update_settings AJAX handler. This manipulation of the argument image_hub_api_keys_* causes missing encryption. This vulnerability is registered as CVE-2026-109191. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability has been found in extendthemes Image Hub Plugin up to 1.2.0 and classified as problematic. Affected by this vulnerability is the function update_option of the component image_hub_update_settings AJAX handler. The manipulation of the argument image_hub_api_keys_* with an unknown input leads to a missing encryption vulnerability. The CWE definition for the vulnerability is CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. As an impact it is known to affect confidentiality. The summary by CVE is:

The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked page HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update_option().

The advisory is shared at wordfence.com. This vulnerability is known as CVE-2026-109191 since 10/12/2026. The exploitation appears to be difficult. The attack can be launched remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1600 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• extendthemes

Name

• Image Hub Plugin

Version

• 1.0
• 1.1
• 1.2.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion