CVE-2025-14486

Name of the Vulnerable Software and Affected Versions PixelPlay versions prior to 1.0.3

Description The PixelPlay plugin for WordPress contains a flaw where authorization checks are missing, allowing unauthenticated attackers to delete API keys configured by site administrators. This is achieved by manipulating the clear api type parameter, which can be used to remove keys for services including Pixabay, Unsplash, Pixels, and OpenAI.

Recommendations Update the plugin to a version later than 1.0.2. As a temporary mitigation, restrict access to the functionality associated with the clear api type parameter.