CVE-2025-62866: CSRF in Auto Alt Text WordPress Plugin

The CSRF vulnerability in Auto Alt Text allows an attacker to craft malicious requests that appear to originate from a legitimate user. Successful exploitation could lead to an attacker modifying image alt text, potentially impacting SEO or defacing a website. While the direct impact might seem limited, CSRF vulnerabilities are often used as a stepping stone for more significant attacks, such as gaining access to administrative functions if other vulnerabilities are present. The blast radius depends on the permissions granted to the affected user account.

1. Reserved2025-10-24
2. Published2025-12-09
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation is to upgrade the Auto Alt Text plugin to version 2.5.3 or later. If upgrading is not immediately feasible, consider implementing a Content Security Policy (CSP) to restrict the sources from which the browser can load resources. Additionally, implement strict input validation and output encoding to prevent malicious data from being processed. Web Application Firewalls (WAFs) configured to detect and block CSRF attacks can provide an additional layer of protection.

Active installs

3KNiche

Plugin rating