This vulnerability in the Ai Image Alt Text Generator for WP plugin permits exposure of sensitive system information to an unauthorized control sphere. Specifically, users with some privileges but not full administrative rights may retrieve embedded sensitive data. The affected versions include all versions up to 1.1.9. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. The impact is limited to confidentiality loss, with no impact on integrity or availability.

An attacker with limited privileges can access sensitive system information embedded within the plugin, potentially aiding further attacks or reconnaissance. However, the vulnerability does not allow modification or disruption of system functionality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin access to trusted users only and monitor for unusual activity related to this plugin. Avoid granting unnecessary privileges that could be leveraged to exploit this vulnerability.