CVE-2026-1085 identifies a CSRF vulnerability in the True Ranker plugin for WordPress, affecting all versions up to 2.2.9. The issue arises from the absence of nonce validation on the seolocalrank-signout action, enabling attackers to craft malicious requests that, when executed by an administrator, disconnect the administrator's True Ranker account without authorization. The vulnerability requires user interaction (UI:R) but no privileges (PR:N) and can be exploited remotely (AV:N).

The vulnerability allows an attacker to cause an administrator to unknowingly disconnect their True Ranker account, resulting in limited integrity impact. There is no direct confidentiality or availability impact reported. The attack requires tricking an administrator into performing an action such as clicking a link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links and consider implementing additional CSRF protections or disabling the affected action if possible.