CVE-2026-91108: CWE-862 Missing Authorization in alttextai Alt Text AI – Automatically generate image alt text for SEO and accessibility
The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.10.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the post_content of any post or page on the site — including content they do not own — with LLM-generated text influenced by attacker-controlled keywords, enabling black-hat SEO manipulation and unauthorized consumption of the site owner's paid AltText.ai API credits. The nonce required to invoke the action is emitted on every admin page including /wp-admin/profile.php, which is accessible to Subscribers, making the nonce trivially obtainable by any authenticated user.
AI Analysis
Technical Summary
CVE-2026-91108 describes an authorization bypass vulnerability (CWE-862) in the Alt Text AI WordPress plugin (versions up to and including 1.10.41). The plugin does not correctly verify that a user is authorized to perform certain actions, allowing authenticated users with subscriber-level privileges or higher to overwrite the post_content of any post or page on the site. The nonce required to invoke this action is exposed on admin pages accessible to subscribers, making it easy for attackers to obtain and exploit. This can lead to unauthorized content modification influenced by attacker-controlled keywords, facilitating black-hat SEO manipulation and unauthorized consumption of the site owner's paid AltText.ai API credits.
Potential Impact
Authenticated users with subscriber-level access can overwrite content of any post or page, potentially manipulating SEO content and depleting the site owner's paid API credits. There is no impact on confidentiality or availability reported. The CVSS score is 4.3 (medium severity), reflecting limited impact confined to integrity.
Mitigation Recommendations
No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for unauthorized content changes.
CVE-2026-91108: CWE-862 Missing Authorization in alttextai Alt Text AI – Automatically generate image alt text for SEO and accessibility
Description
The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.10.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the post_content of any post or page on the site — including content they do not own — with LLM-generated text influenced by attacker-controlled keywords, enabling black-hat SEO manipulation and unauthorized consumption of the site owner's paid AltText.ai API credits. The nonce required to invoke the action is emitted on every admin page including /wp-admin/profile.php, which is accessible to Subscribers, making the nonce trivially obtainable by any authenticated user.
CVSS v3.1
Score 4.3medium
Affected software
alttextai
Alt Text AI – Automatically generate image alt text for SEO and accessibility
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-91108 describes an authorization bypass vulnerability (CWE-862) in the Alt Text AI WordPress plugin (versions up to and including 1.10.41). The plugin does not correctly verify that a user is authorized to perform certain actions, allowing authenticated users with subscriber-level privileges or higher to overwrite the post_content of any post or page on the site. The nonce required to invoke this action is exposed on admin pages accessible to subscribers, making it easy for attackers to obtain and exploit. This can lead to unauthorized content modification influenced by attacker-controlled keywords, facilitating black-hat SEO manipulation and unauthorized consumption of the site owner's paid AltText.ai API credits.
Potential Impact
Authenticated users with subscriber-level access can overwrite content of any post or page, potentially manipulating SEO content and depleting the site owner's paid API credits. There is no impact on confidentiality or availability reported. The CVSS score is 4.3 (medium severity), reflecting limited impact confined to integrity.
Mitigation Recommendations
No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for unauthorized content changes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-09-14T19:34:00.791Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac096c0a43b0b3b89a12234
Added to database: 10/03/2026, 05:46:40 UTC
Last enriched: 10/03/2026, 06:01:52 UTC
Last updated: 10/04/2026, 03:49:48 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.