Cross-Site Request Forgery Vulnerability in Bulk SEO Image Plugin for WordPress

CVE-2026-11997

What is CVE-2026-11997?

The Bulk SEO Image plugin for WordPress is vulnerable to Cross-Site Request Forgery due to insufficient nonce validation within its settings page handler. This flaw allows unauthenticated attackers to potentially manipulate image ALT-text metadata across a site by tricking an administrator into executing a crafted request. Specifically, the plugin lacks necessary nonce fields and verification steps such as wp_nonce_field and check_admin_referer, making it susceptible to arbitrary changes to the _wp_attachment_image_alt post meta for images associated with published content.

References