CVE-2026-1076: Star Review Manager WordPress CSRF Flaw

CVE-2026-1076 Overview

The Star Review Manager plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.2.2. This security flaw stems from missing nonce validation on the plugin's settings page, allowing unauthenticated attackers to manipulate the plugin's CSS settings through forged requests. Successful exploitation requires social engineering a site administrator into clicking a malicious link.

Critical Impact

Unauthenticated attackers can modify plugin CSS settings via CSRF, potentially enabling visual defacement, content injection, or phishing attacks on WordPress sites using the vulnerable plugin.

Affected Products

• Star Review Manager WordPress Plugin versions up to and including 1.2.2
• WordPress installations with Star Review Manager plugin enabled
• Sites where administrators may interact with untrusted links while authenticated

Discovery Timeline

• 2026-01-24 - CVE-2026-1076 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-1076

Vulnerability Analysis

This Cross-Site Request Forgery (CWE-352) vulnerability exists due to the absence of proper nonce validation in the Star Review Manager plugin's administrative settings handler. WordPress provides built-in CSRF protection through its nonce system (wp_nonce_field() and wp_verify_nonce() functions), but the vulnerable code path in admin/settings.php fails to implement these security controls.

The vulnerability allows attackers to craft malicious web pages or links that, when visited by an authenticated administrator, will silently submit requests to modify the plugin's CSS settings. Since the plugin does not verify that the request originated from a legitimate form submission within the WordPress admin panel, it processes these forged requests as if they were legitimate administrative actions.

Root Cause

The root cause is the missing implementation of WordPress nonce validation in the settings page handler located at admin/settings.php. Without nonce verification, the plugin cannot distinguish between legitimate administrator actions and forged cross-site requests initiated by attackers. This is a common oversight in WordPress plugin development where developers fail to implement the standard WordPress CSRF protection mechanism.

Attack Vector

The attack requires network access and user interaction to execute. An attacker must craft a malicious page containing a hidden form or JavaScript that targets the vulnerable settings endpoint. When an authenticated WordPress administrator visits this malicious page (through a phishing email, compromised website, or other social engineering technique), the forged request is automatically submitted using the administrator's authenticated session.

The modified CSS settings could be leveraged to inject malicious styles that hide legitimate content, display phishing overlays, redirect user clicks, or deface the website's review display sections. While the direct impact is limited to CSS modification, creative attackers could use this to facilitate more severe attacks against site visitors.

Detection Methods for CVE-2026-1076

Indicators of Compromise

• Unexpected changes to Star Review Manager plugin CSS settings without administrator action
• HTTP POST requests to the plugin settings endpoint originating from external referrers
• Administrator reports of plugin styling changes they did not authorize
• Unusual CSS rules injected into plugin configuration that could indicate malicious styling

Detection Strategies

• Monitor WordPress admin activity logs for settings changes to the Star Review Manager plugin
• Implement referrer header validation at the WAF level for administrative endpoints
• Review web server access logs for suspicious POST requests to /wp-admin/ paths with external referrers
• Deploy WordPress security plugins that log and alert on configuration changes

Monitoring Recommendations

• Enable detailed logging for WordPress administrative actions
• Configure alerts for any plugin settings modifications outside of expected maintenance windows
• Monitor for unusual traffic patterns to administrative endpoints from authenticated sessions
• Implement Content Security Policy (CSP) headers to reduce CSRF attack surface

How to Mitigate CVE-2026-1076

Immediate Actions Required

• Update Star Review Manager plugin to the latest version with CSRF protection implemented
• Review current plugin CSS settings for any unauthorized modifications
• Educate site administrators about the risks of clicking untrusted links while logged into WordPress
• Consider temporarily disabling the plugin until a patched version is available

Patch Information

The vulnerability affects Star Review Manager versions up to and including 1.2.2. Administrators should check the WordPress plugin repository for updated versions that include proper nonce validation. The fix requires implementing wp_nonce_field() in the settings form and wp_verify_nonce() validation in the form processing handler. Technical details are available in the Wordfence Vulnerability Analysis and the WordPress Plugin Settings File.

Workarounds

• Implement a Web Application Firewall (WAF) rule to block requests to the plugin settings endpoint lacking proper referrer headers
• Restrict administrative access to trusted IP addresses only
• Use browser extensions or security policies that prevent automatic form submissions to administrative endpoints
• Ensure administrators log out of WordPress before browsing external websites

# WordPress .htaccess workaround - restrict settings access by referrer
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} star-review-manager.*settings [NC]
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
    RewriteCond %{REQUEST_METHOD} POST
    RewriteRule .* - [F,L]
</IfModule>