CVE-2026-91108 alttextai CVE debrief

Who should care

WordPress site administrators and security teams should assess exposure and apply patches to prevent potential black-hat SEO manipulation and unauthorized consumption of paid AltText.ai API credits.

Why it matters

CVE-2026-91108 is a medium-severity vulnerability in the Alt Text AI plugin for WordPress, allowing authenticated attackers to overwrite post content. WordPress site administrators and security teams should assess exposure and apply patches to prevent potential security consequences.

• Potential black-hat SEO manipulation through unauthorized post content changes
• Unauthorized consumption of paid AltText.ai API credits
• Increased risk of phishing or malicious content injection
• Potential reputational damage due to unauthorized content changes

Technical summary

The Alt Text AI plugin for WordPress is vulnerable to authorization bypass due to improper verification of user authorization. This allows authenticated attackers with subscriber-level access and above to overwrite post content with LLM-generated text influenced by attacker-controlled keywords. The vulnerability is caused by inadequate authorization checks in the plugin, which enable attackers to obtain a nonce required to invoke the action from the /wp-admin/profile.php page, accessible to Subscribers. This could lead to potential black-hat SEO manipulation and unauthorized consumption of paid AltText.ai API credits.

Defensive priority

Medium priority for WordPress site administrators and security teams to assess exposure and apply patches

Recommended defensive actions

• Assess exposure by checking if the Alt Text AI plugin is installed and if the version is 1.10.41 or earlier
• Verify that the plugin has been updated to a patched version
• Monitor for suspicious activity, such as unauthorized changes to post content
• Consider implementing additional security measures, such as role-based access control and content validation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is due to improper authorization checks in the plugin, allowing attackers to obtain a nonce required to invoke the action from the /wp-admin/profile.php page, which is accessible to Subscribers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.