CVE-2026-24579
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | ai_image_alt_text_generator_for_wp | to 1.1.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24579 is a Broken Access Control vulnerability in the WordPress plugin 'Ai Image Alt Text Generator for WP' (versions up to 1.1.9). It occurs due to missing authorization, authentication, or nonce token checks in certain functions, which may allow unprivileged users (like subscribers) to perform actions that should be restricted to higher-privileged roles such as developers. [1]
How can this vulnerability impact me? :
This vulnerability could allow users with low privileges to execute actions reserved for higher-privileged users, potentially leading to unauthorized changes or access within the WordPress plugin. However, the impact is considered low severity with a CVSS score of 4.3, and it is unlikely to be exploited. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves missing authorization checks in the Ai Image Alt Text Generator for WP plugin, allowing unprivileged users to perform restricted actions. Detection would involve auditing access control by reviewing plugin function calls and user role permissions. However, no specific detection commands or network indicators are provided. It is recommended to monitor WordPress user activity logs for unauthorized actions related to this plugin. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official fix or patched version is available as of the publication date, immediate mitigation steps include restricting user roles to trusted users only, disabling or uninstalling the Ai Image Alt Text Generator for WP plugin if not essential, and using security plugins or services such as Patchstack's mitigation services to help protect against exploitation. [1]