Sensitive Information Exposure in Image Hub WordPress Plugin

CVE-2026-109191

What is CVE-2026-109191?

The Image Hub plugin for WordPress allows authenticated users with subscriber-level access to expose sensitive API credentials for multiple third-party services. Specifically, this vulnerability occurs through the 'image_hub_api_keys_*' parameter, where plaintext API credentials are rendered in the HTML of every admin page. Additionally, the leaked HTML contains a valid AJAX nonce, enabling unauthorized manipulation of API settings without proper capability checks, posing a significant risk to the integrity and security of stored credentials.

References