Description

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys (Pixabay, Unsplash, Pixels, OpenAI) configured by site administrators via the 'clear_api_type' parameter.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-22T08:16:35.857Z",
  "pubdate": "2026-09-22T08:16:35.857Z",
  "executiveSummary": "The PixelPlay WordPress plugin, in versions up to and including 1.0.2, contains a critical security vulnerability involving improper authorization for administrative actions.\nThe vulnerability is classified as an Unauthorized API Key Deletion flaw, arising from missing permission checks within the plugin's API management functionality.\nThis defect allows unauthenticated remote attackers to trigger the deletion of sensitive third-party integration keys, specifically those for Pixabay, Unsplash, Pexels, and OpenAI.\nThe impact includes service disruption, loss of functional integration, and potential compromise of site workflows that depend on these external API services.\nNo authentication or specific privileges are required for an attacker to perform this action, making the system highly susceptible to automated or manual exploitation.\nThe risk implication is significant as it facilitates unauthorized modification of plugin configurations without any requirement for administrative credentials.",
  "technicalDetails": "The vulnerability resides in the PixelPlay plugin's handling of API configuration requests, specifically within the logic responsible for resetting or clearing stored service credentials.\nThe root cause of this vulnerability is the complete absence of capability checks or nonce verification within the request handling function associated with the 'clear_api_type' parameter.\nIn a secure implementation, actions that modify plugin settings or delete stored configurations must be gated by WordPress functions such as current_user_can() to ensure the requester possesses the 'manage_options' capability or equivalent administrative privileges.\nThe attack flow initiates when an unauthenticated actor sends a crafted HTTP request to the WordPress backend endpoint responsible for plugin settings management.\nBy targeting the vulnerable function and injecting the 'clear_api_type' parameter, an attacker can designate specific service identifiers for deletion.\nThe server, lacking validation logic, executes the deletion routine on the database entry associated with the provided parameter value, effectively purging the API key configuration for the specified service.\nSince the affected plugin versions fail to perform even a basic CSRF check or session verification, the exploit is trivial to execute remotely via standard GET or POST requests.\nThe scope of the impact is limited to the deletion of stored configuration data, but in a production environment, this results in immediate service degradation, necessitating manual intervention by an administrator to restore functionality.\nBecause this operation does not involve complex memory corruption or bypasses of security sandboxes, it is classified as a simple logic error within the plugin’s request handling architecture, exposing it to potential mass exploitation by automated vulnerability scanners.\nThis flaw underscores the necessity for robust implementation of WordPress security best practices, including mandatory capability verification and non-predictable nonce validation for all administrative-level actions performed via the plugin interface."
}