CVE-2025-12113 is a missing authorization vulnerability (CWE-862) in the webtoffee Alt Text Generator AI WordPress plugin affecting all versions up to 1.8.3. The atgai_delete_api_key() function lacks proper capability checks, enabling authenticated users with Subscriber-level privileges or above to delete the API key used by the plugin. This unauthorized action can disrupt plugin functionality by removing the API key but does not disclose sensitive data or cause denial of service. The vulnerability is network exploitable with low attack complexity and no user interaction required.

The vulnerability allows unauthorized deletion of the API key by authenticated users with low privileges (Subscriber or higher). This results in integrity impact due to loss of the API key, potentially disrupting the plugin's ability to function correctly. There is no impact on confidentiality or availability according to the CVSS vector. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access where possible and monitor for unauthorized changes to plugin settings. Avoid granting unnecessary privileges to low-level authenticated users. Follow vendor updates closely for any released patches or official mitigations.