CVE-2026-1086 is a CSRF vulnerability in the Font Pairing Preview For Landing Pages WordPress plugin (versions up to 1.3). The issue arises because the plugin does not implement nonce validation on the settings update endpoint, allowing attackers to forge requests that modify plugin settings without proper authorization. Exploitation requires tricking an authenticated administrator into executing the malicious request, typically via social engineering. The vulnerability impacts the integrity of the plugin's configuration but does not affect confidentiality or availability.

An attacker can modify the font pairing settings of the plugin without authentication by exploiting the CSRF vulnerability. This impacts the integrity of the plugin's configuration but does not disclose sensitive information or cause denial of service. The attack requires user interaction from an administrator, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links while logged into WordPress and consider restricting administrative access to trusted users only. Monitoring for plugin updates from wpsolutions is recommended to apply any forthcoming official fixes promptly.