CVE-2026-8910 is a Cross-Site Request Forgery (CWE-352) vulnerability affecting the WP Emoticon Rating plugin for WordPress in all versions up to and including 1.0.1. The issue arises from missing or incorrect nonce validation on a function, enabling attackers to craft forged requests that, when executed by a site administrator, can update plugin settings or inject malicious web scripts. The vulnerability requires user interaction (UI:R) and has network attack vector (AV:N) with low attack complexity (AC:L). The impact includes limited confidentiality and integrity loss but no availability impact.

An attacker can exploit this vulnerability by tricking a site administrator into executing a forged request, which can lead to unauthorized changes in plugin settings and injection of malicious scripts. This compromises the confidentiality and integrity of the affected site components but does not affect availability. The vulnerability does not require prior authentication but does require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links and consider disabling or removing the WP Emoticon Rating plugin if not essential. Monitor official channels for updates or patches from the plugin author.