CVE-2026-1072 is a CSRF vulnerability in the Keybase.io Verification WordPress plugin (versions up to 1.4.5) caused by missing nonce validation during settings updates. This flaw permits unauthenticated attackers to alter the Keybase verification text by tricking an administrator into executing a crafted request. The vulnerability has a CVSS 3.1 score of 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but user interaction needed. No official patch or fix has been published as of the data provided.

An attacker can modify the Keybase verification text on a vulnerable WordPress site without authentication by exploiting the CSRF vulnerability. This could lead to misleading verification information being displayed, potentially undermining trust in the site's identity verification. There is no direct confidentiality, availability, or privilege escalation impact reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on suspicious links and consider implementing additional CSRF protections such as web application firewalls or custom nonce validation. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming official fixes.