Alt Text Ai Automatically Generate Image Alt Text For Seo And Accessibility
Monthly
Authorization bypass in the Alt Text AI WordPress plugin (≤1.10.41) allows any authenticated user with subscriber-level access to overwrite the content of arbitrary posts and pages with LLM-generated text, enabling SEO poisoning and unauthorized consumption of the site owner's AltText.ai API credits. The vulnerability is a low-severity (CVSS 4.3) missing authorization check (CWE-862) that is exploitable because the required nonce is trivially obtainable on the subscriber-accessible profile page. No public exploit has been identified at time of analysis, and the vendor has published a code changeset that appears to remediate the issue.
Authorization bypass in the Alt Text AI WordPress plugin (≤1.10.41) allows any authenticated user with subscriber-level access to overwrite the content of arbitrary posts and pages with LLM-generated text, enabling SEO poisoning and unauthorized consumption of the site owner's AltText.ai API credits. The vulnerability is a low-severity (CVSS 4.3) missing authorization check (CWE-862) that is exploitable because the required nonce is trivially obtainable on the subscriber-accessible profile page. No public exploit has been identified at time of analysis, and the vendor has published a code changeset that appears to remediate the issue.