The Ai Image Alt Text Generator for WP plugin contains a flaw that allows an attacker to read sensitive system information that should be protected. This issue is classified as CWE‑497, reflecting a vulnerability that exposes confidential data to unauthorized parties. The exposed data could provide insight into the underlying WordPress host, potentially enabling further attacks if combined with other weaknesses.

All releases of the AI Image Alt Text Generator for WP plugin up through version 1.1.9 are affected. The plugin is distributed by WP Messiah, a WordPress plugin vendor. No specific hardware or operating system prerequisites are listed; the vulnerability exists entirely within the WordPress plugin code.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% points to a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely need access to the WordPress administrative interface or be able to send crafted requests to the plugin’s data endpoint; the description infers that the vulnerability can be triggered without authentication, but this is not explicitly stated.