CVE-2026-11997 describes a CSRF vulnerability in the Bulk SEO Image plugin for WordPress versions up to and including 1.1. The vulnerability arises because the plugin's settings page handler BulkSeoImage() does not emit a wp_nonce_field() in its form and does not perform check_admin_referer() or wp_verify_nonce() before executing bulk-overwrites of the _wp_attachment_image_alt post meta for all images attached to published posts and pages. An attacker can exploit this by tricking an authenticated administrator into submitting a crafted POST request containing 'bulkseoimage', resulting in unauthorized modification of image ALT-text metadata site-wide.

The vulnerability allows an unauthenticated attacker to cause an authenticated administrator to unknowingly bulk-overwrite image ALT-text metadata across the entire WordPress site. This impacts the integrity of image metadata but does not affect confidentiality or availability. The CVSS score is 4.3 (medium), reflecting low complexity and no privileges required but requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on suspicious links or performing untrusted actions while logged into the WordPress admin interface. Monitoring for plugin updates that add nonce validation and implementing manual nonce checks or disabling the plugin temporarily may reduce risk.