CVE-2025-14486: The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in
mediumvulnerability
security
Summary
The PixelPlay plugin for WordPress (up to version 1.0.2) has a security flaw where it fails to verify that a user has permission before allowing them to delete API keys (authentication credentials for services like OpenAI). This means anyone, even without a WordPress account, can delete important API keys that administrators set up by manipulating a web request parameter called 'clear_api_type'.
Vulnerability Details
CVSS Score
5.3(medium)
EPSS (30-day exploit probability)
EPSS: 0.0%
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
network
Attack Complexity
low
Privileges Required
none
User Interaction
none
Disclosure Date
September 22, 2026
Classification
Attack Type
Other
Attack SophisticationTrivial
Impact (CIA+S)
integrityavailability
Affected Vendors
OpenAI
Related Issues
Monthly digest — independent AI security research
Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-14486
First tracked: September 22, 2026 at 08:09 AM
Classified by LLM (prompt v3) · confidence: 75%