PT-2026-4580 · WordPress · Star Review Manager

Muhammad Afnaan · Published 2026-01-24 · Updated 2026-01-24 · CVE-2026-1076

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Star Review Manager plugin for WordPress versions up to and including 1.2.2

Description The Star Review Manager plugin for WordPress is susceptible to Cross-Site Request Forgery due to the absence of nonce validation on the settings page. This allows unauthenticated attackers to modify the plugin’s CSS settings by forging requests, provided they can deceive a site administrator into performing an action, such as clicking a link.

Recommendations Update the Star Review Manager plugin to a version newer than 1.2.2.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-1076

Affected Products

Star Review Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-1076 · Security Note
• https://plugins.trac.wordpress.org/browser/star-review-manager/trunk/admin/settings.php#L3 · Note
• https://plugins.trac.wordpress.org/browser/star-review-manager/tags/1.2.2/admin/settings.php#L3 · Note
• https://twitter.com/CVEnew/status/2014995789190402226 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2015001345997107212 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/54b6a141-eb4c-4cf0-a078-5b3aeda25466?source=cve · Note