Medium severity5.3NVD Advisory· Published Sep 22, 2026· Updated Oct 14, 2026
CVE-2025-14486
CVE-2025-14486
Description
The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys (Pixabay, Unsplash, Pixels, OpenAI) configured by site administrators via the 'clear_api_type' parameter.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)Wordfence Blog · Oct 1, 2026