What happened
The AI Alt Text Generator plugin's AJAX handler lacks a proper capability/ownership check, so an unauthenticated actor can overwrite the alt text (and optional title/caption/excerpt/content) of arbitrary attachments. CVSS 5.3, published 2026-11-03; CISA SSVC notes exploitation 'none' but automatable 'yes'.
Why it matters
AI-image-automation plugins are a low-value but real surface: an unauthenticated content-integrity bypass on a WordPress AI plugin lets an attacker tamper with metadata/SEO/accessibility text across the whole media library. Low blast radius, so it's kept as a precision catalogued CVE rather than a high-urgency item.
Attack vector
Authorization bypass (CWE-862) — the plugin does not verify the actor is authorized for the target attachment. An unauthenticated attacker (with a Contributor-level account only to extract the nonce from the page source) can modify the AI-generated alt text/caption/title/description of any user's media attachments.
Affected systems
AI Alt Text Generator WordPress plugin <= 2.7.0 (migkapa)
Mitigation
Update the plugin to a fixed version. Wordfence advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/fa4741fa-0871-4f23-b164-94f5e94f5712