CVE-2026-1082 is a CSRF vulnerability in the TITLE ANIMATOR WordPress plugin caused by the absence of nonce validation in the settings page form handler located in inc/settings-page.php. This flaw enables attackers to perform unauthorized changes to plugin settings by exploiting the trust of an authenticated administrator who interacts with a crafted request. The vulnerability affects all versions up to and including 1.0. The CVSS 3.1 score of 4.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on integrity only.

An attacker can modify the plugin's settings without authentication by tricking an administrator into clicking a malicious link, potentially altering site behavior controlled by the plugin. There is no direct impact on confidentiality or availability reported. The vulnerability does not allow code execution or data disclosure but can lead to unauthorized configuration changes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking untrusted links and consider restricting access to the plugin settings page. Monitoring for updates from the plugin author or WordPress security advisories is recommended.