CVE-2026-91108

Name of the Vulnerable Software and Affected Versions Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress versions prior to 1.10.42

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can overwrite the post content of any post or page, regardless of ownership, using LLM-generated text influenced by attacker-controlled keywords. This allows for black-hat SEO manipulation and unauthorized use of the site owner's paid API credits. The required nonce is emitted on every admin page, including the /wp-admin/profile.php endpoint, making it easily obtainable by any authenticated user.

Recommendations Update the plugin to version 1.10.42 or later.