AI Alt Text Authorization Bypass: Secure Your Images for SEO and AEO

On 3 November 2026, Wordfence and other trackers published CVE-2026-120578. The AI Alt Text Generator plugin (migkapa) versions up to 2.7.0 contained a missing authorization check. An attacker with Contributor-level access could modify the alt text of any attachment owned by another user. If the plugin options set_title, set_caption, or set_description were enabled, the same request could also overwrite title, caption, and description.

The issue is patched in version 2.7.1. CVSS is 5.3 (Medium). Exploitation requires a valid nonce obtained from post.php, post-new.php, or upload.php pages. It is not a remote unauthenticated RCE, but it can compromise the integrity of image metadata that search engines and AI systems rely on.

Why this matters for site owners

Alt text is not just accessibility. Descriptive, accurate alt text is one of the signals AI Overviews, ChatGPT, and other answer engines use when deciding what an image represents and whether a page is citable. Corrupted or attacker-controlled alt text can:

• Mislead screen readers and users.
• Reduce the quality of AI-generated citations that reference your images.
• Create inconsistent entity signals across your site.

Many sites still have large numbers of images with missing or generic alt text. Adding an untrusted automation layer without proper access controls multiplies the risk.

Immediate actions

1. Check if the AI Alt Text Generator plugin is installed. If the version is 2.7.0 or earlier, update to 2.7.1 or later immediately.
2. Restrict the Contributor role. Prefer Editor or higher for users who should be able to generate or edit media metadata.
3. Disable the set_title, set_caption, and set_description options unless you have a clear operational need and have reviewed the code path.
4. Audit recent attachment metadata changes if you have Contributor accounts and the plugin was active.

A more durable approach

Automated alt text generation is useful when volume is high, but it must sit behind proper capability checks and human review for high-value images.

• Run a free SEO Audit from the WordPressistic Tools Hub to surface missing alt text across key pages.
• Use SEOISTIC for structured metadata, schema, and answer-ready content that AI systems can cite cleanly. See the AEO Guide for current citation patterns.
• For bulk or recurring work, prefer scoped automation with explicit approvals and snapshots over plugins that expose broad write paths to lower roles.

Accurate, reviewed alt text improves both accessibility compliance and the chance that AI Overviews and ChatGPT correctly describe and cite your visual content.

Last updated: 4 November 2026. Sources: Wordfence, Patchstack, and CVE records for CVE-2026-120578.