Security Alert Summary
The PixelPlay plugin for WordPress has a vulnerability that allows unauthenticated attackers to delete configured API keys (Pixabay, Unsplash, Pixels, OpenAI) because authorization checks are missing. The issue affects all versions up to and including 1.0.2 and can be triggered via the clear_api_type parameter.
CVE Details
- CVE ID: CVE-2025-14486
- Affected plugin: PixelPlay plugin for WordPress
- Affected versions: Versions up to and including 1.0.2 (<= 1.0.2)
- Published: September 22, 2026 at 8:16:35 AM
- Last modified: September 22, 2026 at 11:17:22 AM
- CVSS v3.1: Base Score 5.3, MEDIUM — Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: No authentication required; Privileges Required: NONE; User Interaction: NONE; Attack Vector: NETWORK; Attack Complexity: LOW
- Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-862 (Missing Authorization)
Technical Details
The vulnerability is caused by missing authorization checks in the PixelPlay plugin. An attacker can supply the clear_api_type parameter to trigger deletion of API keys without authenticating. The description specifically notes that arbitrary API keys for services such as Pixabay, Unsplash, Pixels, and OpenAI can be deleted.
Because authorization is not verified before performing the deletion action, the plugin accepts the request and removes configured API keys. The impact is limited to the integrity of those API configurations: keys may be removed, causing integrations that rely on them to fail until keys are restored or reconfigured.
How This Could Impact Your Website
Consider a typical site with an owner, internal content staff, and an external contractor who helps with media. If an attacker deletes configured API keys, image sourcing or AI integrations used by editors and contributors can stop working. This can disrupt publishing workflows and require administrators to reconfigure services.
Operationally, staff may receive unexpected errors or be asked to reauthorize services, which can increase the chance that someone clicks an unsolicited link or follows misleading instructions during remediation attempts. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and any accounts with publishing permissions.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and logs for unusual behavior related to API configuration changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
