The Ai Image Alt Text Generator for WP plugin contains a critical authorization flaw that permits unauthenticated attackers to manipulate plugin functionality.

This vulnerability is a missing authorization flaw (CWE-862) that occurs because the plugin fails to perform necessary capability checks on sensitive functions. The CVSS vector indicates that the attack vector is network-based and does not require any user interaction or authentication (PR:N).

The ability for an unauthenticated user to bypass access controls presents a significant security risk to the WordPress environment. With a CVSS score of 8.2, this high-severity vulnerability could lead to unauthorized data modification or partial service disruption, potentially affecting site integrity and administrative operations.

Immediate Action: Since no patch is currently confirmed, administrators should immediately deactivate and remove the Ai Image Alt Text Generator for WP plugin from all WordPress installations until a vendor-supplied security update is released.

Proactive Monitoring: Review web server access logs for unusual requests originating from unknown IP addresses, specifically targeting endpoints associated with the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests directed at the plugin's specific file paths, which may mitigate exploitation attempts against the missing authorization flaw.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the potential for unauthenticated access, this vulnerability poses a substantial risk to site security. Administrators are strongly advised to prioritize the removal of the affected plugin until the vendor provides a patched version to eliminate this security gap.