CVE-2026-66428 is an unauthenticated CSRF vulnerability in the WP Google Review Slider plugin (versions <= 18.4). The vulnerability allows an attacker to trick users into submitting unauthorized requests that may alter plugin behavior or settings without their consent. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No vendor advisory or patch information is available at this time.

The vulnerability enables an attacker to perform unauthorized actions by exploiting CSRF, potentially modifying plugin settings or behavior. There is no direct confidentiality or availability impact, but integrity of the affected plugin's state can be compromised. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing CSRF protections such as verifying nonces or tokens in requests where possible. Monitor official vendor channels for updates.