EUVD-2026-38688
GHSA-pphr-r45w-j4jp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attacker needs no privileges (PR:N); admin must actively visit malicious page (UI:R); impact is integrity-only ALT-text overwrite with no confidentiality or availability loss.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Bulk SEO Image plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1. This is due to missing or incorrect nonce validation on the plugin's settings page handler BulkSeoImage(), which dispatches to launchbulk() / BulkSeoImageGo() whenever the request contains $_POST['bulkseoimage']. No wp_nonce_field() is emitted in the form and no check_admin_referer()/wp_verify_nonce() is performed before bulk-overwriting the _wp_attachment_image_alt post meta for every image attached to every published post and/or page. This makes it possible for unauthenticated attackers to bulk-overwrite image ALT-text metadata across the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-Site Request Forgery in the Bulk SEO Image WordPress plugin (versions ≤ 1.1) enables unauthenticated attackers to bulk-overwrite every image ALT-text attribute across all published posts and pages on a target site by tricking an authenticated administrator into visiting a malicious page. The plugin's core handler BulkSeoImage() dispatches to launchbulk() and BulkSeoImageGo() whenever a POST request includes the 'bulkseoimage' parameter, with no wp_nonce_field() emitted in the form and no check_admin_referer() or wp_verify_nonce() call gating execution - confirmed by direct source code review at the plugin's Trac repository. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The Bulk SEO Image plugin (CPE: cpe:2.3:a:seo_tools:bulk_seo_image:*:*:*:*:*:*:*:*) is a WordPress plugin that automates bulk updating of the _wp_attachment_image_alt post meta field across all images attached to published posts and pages. The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery): the plugin's PHP handler triggers a destructive bulk-write operation solely on the presence of $_POST['bulkseoimage'] without verifying request origin via WordPress's built-in nonce mechanism. Source code at bulk-seo-image.php lines L11, L76, and L147 (version 1.1 tag on plugins.trac.wordpress.org) confirms the complete absence of nonce issuance and verification. Because WordPress CSRF protection relies entirely on developer-implemented nonces, omitting them leaves the state-changing endpoint fully exploitable via forged cross-origin requests from any attacker-controlled page that an authenticated admin visits.
RemediationAI
No vendor-released patched version has been identified at time of analysis. WordPress site administrators running Bulk SEO Image version 1.1 or earlier should deactivate and uninstall the plugin immediately until a patched release is confirmed available. As a compensating control, administrators can restrict access to the WordPress admin panel (/wp-admin/) by IP allowlist at the web server or firewall level, which reduces the attack surface for CSRF by limiting who can hold an authenticated admin session - note this does not eliminate CSRF risk if the admin browses from an allowlisted IP. A Web Application Firewall rule blocking POST requests containing the 'bulkseoimage' parameter to wp-admin endpoints can also serve as a stopgap with minimal functional side effect since the plugin would simply not process bulk operations. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ef176a6c-33d1-45d6-8a1d-3df1e8eb2170 and the WordPress plugin repository for a patched release.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today