Exploitation Research Plan - CVE-2026-25348 (Alt Text AI)

1. Vulnerability Summary

The Alt Text AI plugin (slug: alttext-ai) for WordPress is vulnerable to Missing Authorization in versions up to and including 1.10.15. The vulnerability resides in an AJAX handler that fails to implement capability checks (current_user_can()), allowing unauthenticated attackers to trigger sensitive plugin actions. Based on the CVSS vector (Integrity: Low), the vulnerability likely allows modifying non-critical plugin settings (such as the API key or sync options) or triggering the alt-text generation process for images, which could exhaust API credits.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action (Inferred): alttext_ai_save_options or alt_text_ai_update_settings
• HTTP Method: POST
• Payload Parameter: action, alttext_ai_api_key (or similar settings array), and potentially a nonce.
• Authentication: None (Unauthenticated).
• Preconditions: The plugin must be active.

3. Code Flow

1. Entry Point: An AJAX request is sent to admin-ajax.php with an action string (e.g., alttext_ai_save_options).
2. Hook Registration: The plugin registers this action via add_action('wp_ajax_nopriv_alttext_ai_save_options', ...) or fails to check login status within a common handler.
3. Vulnerable Function: The handler function (e.g., alttext_ai_save_options_callback) is executed.
4. Missing Check: The function checks if specific $_POST variables are set but omits if ( ! current_user_can( 'manage_options' ) ) { wp_die(); }.
5. Sink: The function calls update_option( 'alttext_ai_options', ... ) with user-supplied data.

4. Nonce Acquisition Strategy

If the handler implements a nonce check using check_ajax_referer but lacks a capability check, the nonce must be retrieved. In alttext-ai, nonces are typically localized for admin screens.

• Script Handle: alttext-ai-admin or alttext-ai-common (inferred).
• Localization Variable: alttext_ai_obj or alttext_ai_data (inferred).
• Nonce Key: nonce or alttext_ai_nonce (inferred).

Strategy:

1. Since unauthenticated users cannot usually access the admin dashboard to see the localized script, check if the plugin enqueues these scripts on the frontend (e.g., if a "request alt text" button is available on public pages).
2. If the plugin uses a generic nonce or no nonce at all (common in Missing Authorization cases), the request can be sent directly.
3. Note: If the action is registered via wp_ajax_nopriv_, the developer often forgets the nonce check entirely or uses a very weak one.

5. Exploitation Strategy

We will attempt to overwrite the plugin's API key, which is a common "Integrity: Low" impact.

Step 1: Test for Nonce-less Execution
Send a POST request to update the API key without a nonce.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=alttext_ai_save_options&alttext_ai_api_key=EXPLOIT_SUCCESSFUL_KEY
  

Step 2: Alternate Action (Trigger Sync)
If settings update fails, attempt to trigger an image sync which consumes resources.

• Body:

  action=alttext_ai_sync_images
  

6. Test Data Setup

1. Install and activate Alt Text AI version 1.10.15.
2. Navigate to Settings > Alt Text AI and set a dummy API key (e.g., ORIGINAL_KEY_123).
3. Ensure at least one image exists in the Media Library to provide a target for sync actions.

7. Expected Results

• HTTP Response: 200 OK or a JSON response like {"success":true}.
• Effect: The WordPress option alttext_ai_options (or similar) will be updated in the database, or the plugin will attempt to connect to an external AI service using the malicious API key.

8. Verification Steps

After sending the HTTP request, use WP-CLI to verify the change in the database:

# Check the value of the plugin's settings option
wp option get alttext_ai_options --format=json

Look for the alttext_ai_api_key field within the returned JSON to see if it matches EXPLOIT_SUCCESSFUL_KEY.

9. Alternative Approaches

• Parameter Guessing: If alttext_ai_save_options is not the exact name, check the source for add_action('wp_ajax_nopriv_ and list all registered actions.
• Settings Injection: Attempt to inject other settings like alttext_ai_auto_generate to 1 to force the plugin to process every new upload.
• REST API Check: Check if the plugin registers any routes via register_rest_route in includes/class-alttext-ai-rest.php (inferred) without a permission_callback.