CVE-2026-11997

Name of the Vulnerable Software and Affected Versions Bulk SEO Image versions prior to 1.2

Description The Bulk SEO Image plugin for WordPress is subject to Cross-Site Request Forgery. This occurs because the settings page handler BulkSeoImage() lacks proper nonce validation—a security token used to ensure requests are intentional and authorized—when dispatching to launchbulk() or BulkSeoImageGo() upon receiving the $ POST['bulkseoimage'] variable. Specifically, the plugin fails to implement wp nonce field() in the form and does not utilize check admin referer() or wp verify nonce() before overwriting the wp attachment image alt post meta for images attached to published posts and pages. This allows an attacker to trick a site administrator into clicking a forged link, resulting in the bulk-overwriting of image ALT-text metadata across the site.

Recommendations Update the plugin to a version later than 1.1.