CVE-2026-11997 Bulk SEO Image <= 1.1 - Cross-Site Request Forgery to Settings Update
Unauthenticated attackers can trick administrators into bulk-overwriting image ALT-text metadata across the site via a forged request.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-11997?
CVE-2026-11997 is a medium-severity vulnerability in seo_tools Bulk SEO Image, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Bulk SEO Image plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1. This is due to missing or incorrect nonce validation on the plugin's settings page handler BulkSeoImage(), which dispatches to launchbulk() / BulkSeoImageGo() whenever the request contains $_POST['bulkseoimage']. No wp_nonce_field() is emitted in the form and no check_admin_referer()/wp_verify_nonce() is performed before bulk-overwriting the _wp_attachment_image_alt post meta for every image attached to every published post and/or page. This makes it possible for unauthenticated attackers to bulk-overwrite image ALT-text metadata across the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Weakness: CWE-352
Which versions are affected by CVE-2026-11997?
How do I fix CVE-2026-11997?
No fix has been published for CVE-2026-11997 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-11997 being exploited?
There is no known exploitation of CVE-2026-11997 in the wild and no public exploit code.
Sources
Also known as GHSA-pphr-r45w-j4jp.