The Bulk SEO Image plugin for WordPress contains a CSRF flaw that results from omitted nonce validation in the settings handler. The vulnerability allows an attacker who can trick an administrator into sending a crafted POST request to force the plugin to overwrite the _wp_attachment_image_alt meta field for every image in all published posts and pages. This permission escalation permits unauthorized manipulation of alternate text, potentially harming search engine optimization, breaking accessibility, and erasing author intent. The weakness is identified as CWE‑352.

Any WordPress site that has Bulk SEO Image version 1.1 or earlier installed, including the default 1.0 release and any variant with its settings page enabled, is affected. The flaw exists wherever the plugin’s settings handler is accessible to administrators.

The CVSS score of 4.3 reflects a moderate impact with a normal access vector. EPSS is not provided and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploitation in the wild. An unauthenticated attacker can exploit the flaw by sending a CSRF request from any domain, provided a site administrator follows a malicious link. Although it does not grant remote code execution, it facilitates widespread content alteration. Timely administrator awareness and patching are essential to mitigate the risk.