Star Review Manager <= 1.2.2 - Cross-Site Request Forgery to Settings Update

The primary impact of this CSRF vulnerability lies in the ability of an attacker to manipulate the Star Review Manager plugin's CSS settings. While this might seem cosmetic, it could be leveraged for more malicious purposes. An attacker could alter the plugin's appearance to mislead users, potentially concealing legitimate content or injecting malicious elements. Furthermore, if the CSS settings control other aspects of the plugin's functionality, an attacker could potentially gain further control. This vulnerability highlights the importance of proper nonce validation in WordPress plugins to prevent unauthorized modifications.

WordPress websites utilizing the Star Review Manager plugin, particularly those with shared hosting environments or lacking robust access controls, are at increased risk. Sites where administrators frequently click on links from untrusted sources are also more vulnerable.

• wordpress / composer / npm:

grep -r 'settings_update' /var/www/html/wp-content/plugins/star-review-manager/

• wordpress / composer / npm:

wp plugin list --status=inactive | grep 'star-review-manager'

• wordpress / composer / npm:

wp plugin list --status=active | grep 'star-review-manager'

1. 2026-01-24Disclosure

   disclosure

1. Reserviert2026-01-16
2. Veröffentlicht2026-01-24
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-1076 is to upgrade the Star Review Manager plugin to a version that includes the necessary nonce validation. Until an updated version is available, consider implementing a Web Application Firewall (WAF) rule to block requests to the plugin's settings page that lack proper authentication. Additionally, restrict access to the settings page to authorized administrators only. Monitor WordPress logs for suspicious activity related to the plugin’s settings, looking for unexpected changes to CSS files.