WordPress Plugin Vulnerabilities

Download Alt Text AI < 1.10.18 - Missing Authorization

Description

The Download Alt Text AI plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.10.15. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
alttext-ai
Fixed in 1.10.18

References

CVE
CVE-2026-25348
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/9d7ea5b7-a4d5-4d1d-943e-3ba9635f24a1

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Trương Hữu Phúc (truonghuuphuc)
Verified
No
WPVDB ID
a1f171d1-27bf-487b-84cf-f81e338b502c

Timeline

Publicly Published
2026-02-14 (about 2 months ago)
Added
2026-02-24 (about 2 months ago)
Last Updated
2026-02-24 (about 2 months ago)

Other

Published
Title
Published
2026-01-18
Title
AJAX Hits Counter + Popular Posts Widget <= 0.10.210305 - Missing Authorization
Published
2025-02-28
Title
Secure Copy Content Protection and Content Locking < 4.4.8 - Missing Authorization to Unauthenticated User Email Retrieval via ays_sccp_reports_user_search Function
Published
2025-02-10
Title
Zox News < 3.17.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification
Published
2026-01-09
Title
Contest Gallery < 28.1.2 - Missing Authorization
Published
2026-03-17
Title
Product Slider, Product Grid, Product Masonry < 1.13.62 - Missing Authorization