CVE-2026-91108

The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.10.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the post_content of any post or page on the site — including content they do not own — with LLM-generated text influenced by attacker-controlled keywords, enabling black-hat SEO manipulation and unauthorized consumption of the site owner's paid AltText.ai API credits. The nonce required to invoke the action is emitted on every admin page including /wp-admin/profile.php, which is accessible to Subscribers, making the nonce trivially obtainable by any authenticated user.

• CWE-862

• https://plugins.trac.wordpress.org/browser/alttext-ai/tags/1.10.38/admin/class-atai-admin.php#L75
• https://plugins.trac.wordpress.org/browser/alttext-ai/tags/1.10.38/includes/class-atai-post.php#L275
• https://plugins.trac.wordpress.org/browser/alttext-ai/tags/1.10.38/includes/class-atai.php#L271
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3723468%40alttext-ai&new=3723468%40alttext-ai
• https://www.wordfence.com/threat-intel/vulnerabilities/id/216e3087-52f1-4b2e-a31c-0c2ddf41aefb?source=cve

Published

Oct 3, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-91102HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-91103HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-91104HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-91105HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-91106HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-91107openSIS Classic 9.3 allows an authenticated user with the bu…9.3
• CVE-2026-91109The Simply Schedule Appointments plugin for WordPress is vul…6.5
• CVE-2026-9111Use after free in WebRTC in Google Chrome on Linux prior to …8.8
• CVE-2026-91119Discourse is an open-source discussion platform. Prior to 20…6.4
• CVE-2026-9112Use after free in GPU in Google Chrome on Windows prior to 1…8.8
• CVE-2026-91120Discourse is an open-source discussion platform. Prior to 20…5.4
• CVE-2026-91121Discourse is an open-source discussion platform. Prior to 20…5