The Image Hub plugin for WordPress exposes sensitive credential information for six third‑party image services. By sending the image_hub_api_keys_* parameters, an authenticated user with subscriber level access can cause the plugin to inject the plaintext API keys for Giphy, Openverse, Pexels, Pixabay, and Unsplash directly into the body of every admin page via wp_localize_script. The same level of access also allows the user to overwrite these stored credentials through the image_hub_update_settings AJAX handler, which lacks a capability check and accepts the nonce present in the leaked page. The flaw satisfies CWE‑200 and compromises confidentiality by leaking cryptographic tokens that can be used to access or abuse the related services and to modify site configuration without proper authorization.

WordPress installations that use extendthemes’ Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin version 1.2.0 or earlier are affected. No other versions are known to contain the flaw, and higher plugin versions have not been reported to include this issue.

The CVSS score of 4.3 indicates moderate severity. Exploitation requires only authenticated access at subscriber level or higher and can be performed entirely within the WordPress admin interface, with no external network traffic. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting the current risk is moderate but non‑negligible. Effective exposure of API credentials can be leveraged by any attacker who gains subscriber or higher privileges, making timely remediation important.