The CVE describes a missing authorization flaw in the WP Messiah: Ai Image Alt Text Generator for WP plugin, which allows anyone with internet access to reach endpoints that should be limited to administrators. The plugin therefore lets attackers read or modify alt‑text metadata and potentially other configuration items that should be protected. This improper authorization flaw is categorized as CWE‑862 and can impact confidentiality and integrity of site content.

WP Messiah: Ai Image Alt Text Generator for WP plugins running any version from the earliest documented release up to and including 1.1.1 are affected. The vulnerability is present in all builds within that version range; upgrading beyond 1.1.1 when a fix is released removes the flaw.

With a CVSS score of 5.4 the risk is rated moderate. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the issue remotely by sending specially crafted HTTP requests to the plugin's protected functions without needing privileged credentials, potentially retrieving or tampering with protected information.