Alt Text AI Vulnerable to SQL Injection Attacks

CVE-2024-4847

Summary

The Alt Text AI Plugin for WordPress, designed for automatically generating image alt text to enhance SEO and accessibility, is susceptible to a generic SQL injection flaw. This vulnerability arises from inadequate escaping of the 'last_post_id' parameter, exposing the SQL query to manipulation. Authenticated users with Subscriber-level access and higher can exploit this weakness by injecting additional SQL commands into existing database queries, leading to potential extraction of sensitive data. It is crucial for users of versions up to and including 1.4.9 to apply security updates promptly to mitigate this risk.

References