The Star Review Manager plugin for WordPress contains a Cross‑Site Request Forgery flaw that arises because the settings page omits nonce validation. An attacker who can trick a site administrator into clicking a crafted link can alter the plugin’s CSS settings without any authentication. The change is limited to visual styling but could be leveraged to obscure administrative notices, redirect visitors, or facilitate other social‑engineering tactics. The vulnerability belongs to CWE‑352, indicating missing request forgery protection.

Any WordPress site that installs Star Review Manager version 1.2.2 or earlier, released by the vendor bramdnl, is susceptible. The flaw exists across all supported WordPress configurations and is not restricted to a specific operating system or hosting environment.

With a CVSS base score of 4.3, the inherent severity is low to moderate. The EPSS score of less than 1% shows that, according to current exploit probability models, exploitation is unlikely but not impossible. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires only an unauthenticated administrator to click a malicious link, making the attack vector straightforward. Overall risk remains low for well‑maintained sites that apply timely updates, but the ease of execution warrants prompt remediation.