Exploitation Research Plan: CVE-2026-11997 (Bulk SEO Image CSRF)

1. Vulnerability Summary

The Bulk SEO Image plugin (versions <= 1.1) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The vulnerability exists because the plugin fails to implement nonce validation (via wp_nonce_field() or check_admin_referer()) in its primary administrative handler, BulkSeoImage(). This function triggers a bulk update of image ALT text metadata (_wp_attachment_image_alt) across the entire site by calling launchbulk() and BulkSeoImageGo() whenever a POST request contains the key bulkseoimage.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin.php?page=bulk-seo-image (inferred slug based on standard WordPress naming).
• Hook: Likely admin_menu or admin_init registering the BulkSeoImage callback.
• Vulnerable Parameter: $_POST['bulkseoimage'].
• Authentication: Requires an authenticated administrator session.
• Preconditions: The attacker must trick a logged-in administrator into visiting a malicious page or submitting a form that sends a POST request to the target site.

3. Code Flow

1. Entry Point: An administrator accesses the plugin settings page (likely registered via add_options_page or add_menu_page with the callback BulkSeoImage).
2. Logic Trigger: Inside BulkSeoImage(), the code checks if isset($_POST['bulkseoimage']).
3. Vulnerable Dispatch: Because no check_admin_referer() check exists, the code proceeds to call launchbulk() or BulkSeoImageGo().
4. The Sink: These functions query for all published posts and pages, identify attached images, and use update_post_meta($attachment_id, '_wp_attachment_image_alt', $new_alt_text) to overwrite the metadata for every image on the site.

4. Nonce Acquisition Strategy

According to the vulnerability description, the plugin does not emit a nonce field and does not verify one.

• Nonce Requirement: None. The vulnerability specifically cites "missing or incorrect nonce validation."
• Bypass: Simply omit any nonce parameters. If the plugin's code performs a logic check like if ( !wp_verify_nonce(...) ) but fails to exit/die, or if it is entirely absent, the request will proceed.

5. Exploitation Strategy

The goal is to trigger the bulk metadata overwrite via an unauthenticated external POST request (simulating a CSRF).

Step-by-Step Plan:

1. Identify the exact POST parameters: Use browser_navigate to visit the settings page and inspect the HTML form to see what bulkseoimage value and accompanying settings (like ALT text patterns) are used.
2. Craft the Payload: Create a POST request that mimics the legitimate form submission.
3. Execute via HTTP Request: Use the http_request tool with the administrator's cookies to simulate the CSRF.

Exploit Payload (Conceptual):

URL: http://localhost:8080/wp-admin/admin.php?page=bulk-seo-image (inferred)
Method: POST
Headers: Content-Type: application/x-www-form-urlencoded
Body:

bulkseoimage=1&...[any other parameters found in the form]

6. Test Data Setup

To demonstrate the impact, the test environment must contain images with existing ALT text:

1. Create Posts: Create 2-3 posts/pages with at least one image each.

   wp post create --post_type=post --post_title="Test Post 1" --post_status=publish
   

2. Upload/Attach Images: Upload an image and attach it to the posts.
3. Set Initial ALT Text: Manually set a known ALT text for these images.

   wp post meta update [ATTACHMENT_ID] _wp_attachment_image_alt "Original Alt Text"
   

7. Expected Results

• The server should return a 302 Redirect or a 200 OK indicating the process has run.
• The _wp_attachment_image_alt metadata for all images in the database should be modified according to the plugin's bulk processing logic (e.g., changed to match the post titles).

8. Verification Steps

After sending the POST request, verify the metadata change using WP-CLI:

# Get all image attachment IDs
ATTACHMENTS=$(wp post list --post_type=attachment --format=ids)

# Check the ALT text for each
for ID in $ATTACHMENTS; do
    echo "ID $ID Alt: $(wp post meta get $ID _wp_attachment_image_alt)"
done

If the ALT text no longer matches "Original Alt Text", the CSRF was successful.

9. Alternative Approaches

If the plugin uses a specific button name or additional hidden fields for the bulk action:

1. Form Inspection: Use browser_eval("document.querySelector('form').innerHTML") on the settings page to find all input names.
2. Direct Action: If BulkSeoImage() is hooked to admin_init rather than a menu callback, the request might need to be sent to wp-admin/admin-post.php with an action parameter. Verify the hook registration in the main plugin file.