Plugin WordPress Auto Alt Text <= 2.5.2 - Vulnerabilidade Cross Site Request Forgery (CSRF)

The CSRF vulnerability in Auto Alt Text allows an attacker to craft malicious requests that appear to originate from a legitimate user. Successful exploitation could lead to an attacker modifying image alt text, potentially impacting SEO or defacing a website. While the direct impact might seem limited, CSRF vulnerabilities are often used as a stepping stone for more significant attacks, such as gaining access to administrative functions if other vulnerabilities are present. The blast radius depends on the permissions granted to the affected user account.

Websites using the Auto Alt Text plugin, particularly those with users who have administrative privileges or access to sensitive image assets, are at risk. Shared hosting environments where multiple websites share the same server resources are also potentially vulnerable, as a compromise on one site could impact others.

• wordpress / composer / npm:

grep -r 'wp_nonce_url' /var/www/html/wp-content/plugins/auto-alt-text/

• generic web:

curl -I https://example.com/wp-content/plugins/auto-alt-text/ | grep -i 'referer'

1. 2025-12-09Disclosure

   disclosure

1. Reservado2025-10-24
2. Publicada2025-12-09
3. Modificada2026-04-28
4. EPSS atualizado2026-03-23

The primary mitigation is to upgrade the Auto Alt Text plugin to version 2.5.3 or later. If upgrading is not immediately feasible, consider implementing a Content Security Policy (CSP) to restrict the sources from which the browser can load resources. Additionally, implement strict input validation and output encoding to prevent malicious data from being processed. Web Application Firewalls (WAFs) configured to detect and block CSRF attacks can provide an additional layer of protection.

Instalações ativas

3KNicho

Avaliação do plugin