The AI Alt Text Generator plugin for WordPress up to version 2.7.0 contains an authorization bypass vulnerability. This flaw allows an attacker with a Contributor-level account to modify alt text and optionally other metadata of attachments owned by other users without proper authorization checks. Exploitation requires retrieving a nonce from certain WordPress pages and depends on specific plugin options being enabled for overwriting additional fields.