The Auto Alt Text WordPress plugin contains a Cross‑Site Request Forgery flaw that allows an attacker to trigger state‑changing actions on behalf of an authenticated user, potentially modifying image alt text. This critical weakness, identified as CWE‑352, permits unauthorized manipulation of content that could be used for phishing or defacement. The flaw does not provide direct code execution or data exfiltration, but it does enable an attacker to tamper with content that may affect site reputation and user experience.

All installations of Valerio Monti Auto Alt Text versions up to and including 2.5.2 are affected. The plugin is a WordPress add‑on that enhances media accessibility by automatically generating alt text for images.

The CVSS score of 4.3 indicates a low severity rating, and the EPSS score of less than 1% suggests a small chance of exploitation. The plugin is not listed in the CISA KEV catalog, further flagging low threat activity. Based on the description, the likely attack vector is a CSRF request that the application accepts without a proper anti‑CSRF token or nonce. An attacker would need to lure a logged‑in user to a crafted URL or embed a malicious form to exploit the weakness; no local privilege escalation or remote code execution is involved.