CVE-2026-11997: Bulk SEO Image WordPress Plugin CSRF Vulnerability – Metadata Corruption Risk

Technical summary

The vulnerability resides in the BulkSeoImage() function and its dispatched handlers (launchbulk() / BulkSeoImageGo()), which process POST requests containing the 'bulkseoimage' parameter without verifying nonce tokens. The plugin's settings form neither emits wp_nonce_field() nor validates incoming requests with check_admin_referer() or wp_verify_nonce(). This allows an attacker to construct a forged request that, when a logged-in administrator is tricked into clicking a link, will unconditionally overwrite the _wp_attachment_image_alt post meta across all images attached to every published post and page in the WordPress database.

Business impact

Site administrators face automated defacement of image accessibility metadata across their entire content library. While ALT-text manipulation may seem cosmetic, it degrades user experience for visually impaired visitors who rely on screen readers, introduces SEO degradation, and potentially violates web accessibility compliance standards (WCAG, ADA). The bulk nature of the attack means a single CSRF click can corrupt metadata for hundreds or thousands of images simultaneously, requiring manual remediation or database-level recovery. Reputation and legal exposure increase if accessibility compliance is audited or enforced in the organization's jurisdiction.

Affected systems

The Bulk SEO Image plugin for WordPress versions up to and including 1.1 are affected. Any WordPress installation running this plugin with an administrator account is at risk if that administrator visits an attacker-controlled page or clicks a malicious link while logged in to WordPress. Multisite WordPress installations may face broader impact if a single forged request can affect images across multiple blogs.

Exploitability

Exploitability is relatively straightforward. The attack requires no authentication or special privileges from the attacker's side—only that a site administrator be tricked into clicking a link or visiting a malicious page while logged into WordPress. No special network conditions or complex technical skills are required to craft the CSRF payload. The CVSS score of 4.3 (Medium) reflects the requirement for user interaction (an administrator must click the link) and the absence of confidentiality impact, though the integrity impact to site metadata is confirmed.

Remediation

Update the Bulk SEO Image plugin immediately to a patched version that implements proper nonce validation. Verify against the official plugin repository or vendor advisory for the specific patched version number. Site administrators should also audit their WordPress user roles and ensure only trusted administrators have access to plugin settings. Consider restricting unnecessary administrative privileges and review user account activity logs for evidence of unauthorized bulk ALT-text modifications.

Patch guidance

Check the WordPress plugin repository for the Bulk SEO Image plugin and upgrade to the latest available version. The patched version should include wp_nonce_field() in the plugin's settings form and corresponding check_admin_referer() or wp_verify_nonce() validation before processing bulk operations. Verify the patch notes explicitly confirm that nonce validation has been added to the BulkSeoImage() and related functions. Test the update in a staging environment before deploying to production to ensure compatibility with your WordPress version and other plugins.

Detection guidance

Monitor WordPress database logs for unusual modifications to the _wp_attachment_image_alt post meta fields, particularly if multiple images are modified in a short timeframe without corresponding administrator action. Review WordPress admin audit logs (if enabled via a logging plugin) for POST requests to the plugin's settings handler without an associated administrator activity. Implement security headers like SameSite cookie attributes and Content-Security-Policy to mitigate CSRF attacks across your WordPress site. Consider deploying a WordPress security plugin that provides CSRF detection and general form validation auditing.

Why prioritize this

Although the CVSS score is Medium (4.3), this vulnerability should be treated with urgency because it affects data integrity across an entire site's image library, requires minimal attacker effort, and can be exploited passively via social engineering. The lack of KEV status does not indicate low risk—this is a clear, straightforward CSRF vulnerability with proven exploitation mechanics. Organizations running WordPress sites with significant image content should prioritize updating immediately to prevent bulk metadata corruption.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: Network-accessible attack vector (AV:N), low complexity (AC:L), no privilege requirement from attacker (PR:N), requirement for user interaction (UI:R), limited scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L), and no availability impact (A:N). The integrity impact is limited to metadata rather than content destruction, and user interaction is required, which moderates the overall score. However, the practical impact of bulk metadata corruption justifies close monitoring and rapid patching despite the moderate numerical score.

Frequently asked questions