Is CVE-2026-109191 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109191 being exploited in the wild.

How severe is CVE-2026-109191?

Medium severity, with a CVSS score of 4.3, published 16 October 2026.

Which products and versions are affected?

WordPress.org Image Hub up to and including 1.2.0.

Is there a fix for CVE-2026-109191?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109191 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109191?

Check whether you run WordPress.org Image Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109191: Image Hub WordPress plugin sensitive information exposure

CVE-2026-109191 · Severity: medium · CVSS 4.3 · Published 2026-10-16

The Image Hub plugin for WordPress exposes API credentials for third-party image services (Giphy, Openverse, Pexels, Pixabay, Unsplash) in plain text on admin pages. A subscriber-level user can read these credentials directly from the page HTML and use a leaked AJAX nonce to modify stored API keys without permission, allowing them to redirect image searches or inject malicious content.

Vendors: WordPress.org.

Quick answers

Is CVE-2026-109191 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109191 being exploited in the wild.
How severe is CVE-2026-109191?: Medium severity, with a CVSS score of 4.3, published 16 October 2026.
Which products and versions are affected?: WordPress.org Image Hub up to and including 1.2.0.
Is there a fix for CVE-2026-109191?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109191 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109191?: Check whether you run WordPress.org Image Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin emits API credentials in plaintext into admin page HTML via wp_localize_script() without proper access controls, and also generates a valid AJAX nonce visible to low-privilege users. The image_hub_update_settings AJAX handler lacks capability checks, allowing subscriber-level attackers to call update_option() and overwrite all stored API credentials. Both the information disclosure and the unauthorized settings modification are exploitable by authenticated users with subscriber role or above.

Affected products

wordpress.org Image Hub up to and including 1.2.0

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.