WordPress Alt Text Generator AI Plugin Missing Authorization Vulnerability Allows API Key Deletion

A vulnerability exists in the Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images plugin for WordPress, in all versions through 1.8.3. The issue arises from a missing capability check in the atgai_delete_api_key() function, allowing authenticated attackers with Subscriber-level access and above to delete the API key associated with the site, leading to unauthorized data loss.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of the API key connected to the WordPress site, potentially disrupting services that rely on the API key.

Remediation

Users are advised to update the plugin to version 1.8.4 or a newer patched version.