WordPress Auto Alt Text Plugin <= 2.5.2 - Cross Site Request Forgery (CSRF) Schwachstelle

The CSRF vulnerability in Auto Alt Text allows an attacker to craft malicious requests that appear to originate from a legitimate user. Successful exploitation could lead to an attacker modifying image alt text, potentially impacting SEO or defacing a website. While the direct impact might seem limited, CSRF vulnerabilities are often used as a stepping stone for more significant attacks, such as gaining access to administrative functions if other vulnerabilities are present. The blast radius depends on the permissions granted to the affected user account.

Websites using the Auto Alt Text plugin, particularly those with users who have administrative privileges or access to sensitive image assets, are at risk. Shared hosting environments where multiple websites share the same server resources are also potentially vulnerable, as a compromise on one site could impact others.

• wordpress / composer / npm:

grep -r 'wp_nonce_url' /var/www/html/wp-content/plugins/auto-alt-text/

• generic web:

curl -I https://example.com/wp-content/plugins/auto-alt-text/ | grep -i 'referer'

1. 2025-12-09Disclosure

   disclosure

1. Reserviert2025-10-24
2. Veröffentlicht2025-12-09
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade the Auto Alt Text plugin to version 2.5.3 or later. If upgrading is not immediately feasible, consider implementing a Content Security Policy (CSP) to restrict the sources from which the browser can load resources. Additionally, implement strict input validation and output encoding to prevent malicious data from being processed. Web Application Firewalls (WAFs) configured to detect and block CSRF attacks can provide an additional layer of protection.

Aktive Installationen

3KNische

Plugin-Bewertung