Ai Alt Text Generator
Monthly
Authorization bypass in the AI Alt Text Generator WordPress plugin through 2.7.0 allows a Contributor-level user to modify the alt text of arbitrary attachments owned by other users, with the title, caption, and description also writable when the plugin's set_title, set_caption, or set_description options are enabled. The defect is a missing authorization check (CWE-862); exploitation requires a Contributor account to retrieve a valid nonce from post.php, post-new.php, or upload.php. No public exploit identified at time of analysis and no CISA KEV entry is present; impact is limited to attachment metadata integrity and rated medium severity (CVSS 5.3).
Authorization bypass in the AI Alt Text Generator WordPress plugin through 2.7.0 allows a Contributor-level user to modify the alt text of arbitrary attachments owned by other users, with the title, caption, and description also writable when the plugin's set_title, set_caption, or set_description options are enabled. The defect is a missing authorization check (CWE-862); exploitation requires a Contributor account to retrieve a valid nonce from post.php, post-new.php, or upload.php. No public exploit identified at time of analysis and no CISA KEV entry is present; impact is limited to attachment metadata integrity and rated medium severity (CVSS 5.3).