Authorization Bypass Vulnerability in AI Alt Text Generator Plugin for WordPress

CVE-2026-120578

What is CVE-2026-120578?

The AI Alt Text Generator plugin for WordPress has a significant vulnerability that allows unauthenticated attackers to bypass authorization checks. All versions up to and including 2.7.0 are affected. The flaw stems from the plugin's failure to properly verify user actions, enabling attackers to alter the alt text, title, caption, and description of media attachments belonging to other users. To exploit this vulnerability, an attacker needs a Contributor-level account to access necessary nonces from specific page sources. Certain options must also be enabled to overwrite additional post details.

References