CVE-2026-1076 is a Cross-Site Request Forgery vulnerability in the bramdnl Star Review Manager WordPress plugin versions up to and including 1.2.2. The issue arises from the absence of nonce validation on the settings page, which enables attackers to craft malicious requests that, when executed by an authenticated administrator, can alter the plugin's CSS settings without proper authorization. This vulnerability requires user interaction (UI:R) and does not impact confidentiality or availability but can cause limited integrity loss.

An attacker can cause a site administrator to unknowingly modify the plugin's CSS settings by tricking them into clicking a malicious link or performing a specific action. This results in limited integrity impact on the affected website's appearance or styling controlled by the plugin. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when interacting with untrusted links or content that could trigger unintended actions in the plugin's settings page. Monitoring vendor channels for updates or patches is recommended.