CVE-2025-62866

Name of the Vulnerable Software and Affected Versions Valerio Monti Auto Alt Text versions prior to 2.5.3

Description A Cross-Site Request Forgery (CSRF) issue exists in the Auto Alt Text plugin for WordPress. This occurs due to missing or incorrect nonce validation—a security mechanism used to ensure that a request was intentionally sent by the user—within the handleAltTextBulkAction() function. This allows unauthenticated attackers to perform unauthorized actions if they can trick a site administrator into clicking a malicious link.

Recommendations Update to a version newer than 2.5.2. As a temporary workaround, restrict access to the handleAltTextBulkAction() function until the update is applied.