Description

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys (Pixabay, Unsplash, Pixels) configured by site administrators via the 'pixabay_api', 'unsplash_api', or 'pixels_api' parameters.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-22T08:16:35.643Z",
  "pubdate": "2026-09-22T08:16:35.643Z",
  "executiveSummary": "The Image Buzz plugin for WordPress, in all versions up to and including 1.0.3, contains a critical security vulnerability involving improper authorization for API key management.\nThe flaw allows unauthenticated remote attackers to modify critical configuration parameters, specifically the 'pixabay_api', 'unsplash_api', and 'pixels_api' keys used for external service integration.\nThe vulnerability stems from a lack of server-side capability checks or nonce verification on the plugin's configuration-saving functionality.\nThis represents a significant security risk, as an attacker can redirect API requests to attacker-controlled accounts, conduct credential harvesting, or disrupt site functionality by invalidating legitimate service integrations.\nNo authentication or administrative privileges are required for exploitation, rendering the plugin susceptible to automated mass-exploitation via publicly accessible network endpoints.\nImpact includes the potential for service hijacking, supply chain disruption, and unauthorized data leakage regarding media service usage.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of the plugin's settings update handler, which fails to enforce access control lists (ACLs) or verify the authenticity of the requester before processing input.\nThe affected plugin component lacks a mandatory 'current_user_can()' check or equivalent authorization logic within its admin-panel save routine, allowing any request targeted at the appropriate endpoint to update the global option fields.\nThe attack flow begins with the attacker identifying the target endpoint responsible for persisting settings. By sending a crafted HTTP POST request to the WordPress REST API or the native admin-ajax/admin-post interface—depending on the plugin's architectural implementation—the attacker can inject arbitrary strings into the 'pixabay_api', 'unsplash_api', or 'pixels_api' database rows.\nBecause the plugin does not validate the integrity of the request via security tokens (nonces), the server processes the payload as a legitimate administrative action.\nExploitation is trivial and network-accessible; a threat actor simply transmits a request containing the desired malicious API keys in the relevant parameter fields. Once processed, the plugin updates the WordPress options table, effectively overriding the legitimate configuration.\nPost-exploitation impact is severe, as the application will subsequently authenticate requests to Pixabay, Unsplash, or Pexels using the attacker's credentials. This allows the attacker to monitor traffic patterns, log the application's activity, or potentially intercept metadata associated with media requests initiated by the compromised site. Furthermore, the attacker can break the plugin's functionality by supplying malformed or invalid keys, resulting in a denial-of-service condition for the site's media-importing features. The lack of validation ensures that these changes persist until manually remediated by a legitimate administrator, facilitating long-term persistence in the site's configuration."
}