diff --git a/includes/ReviewHandler.php b/includes/ReviewHandler.php
index d07bb04..285de52 100644
--- a/includes/ReviewHandler.php
+++ b/includes/ReviewHandler.php
@@ -128,7 +128,8 @@ public function getTemplate() {
 		// used if user right-clicks link and opens in new tab
 		$unReviewURL = SpecialPage::getTitleFor( 'PageStatistics' )->getInternalURL( [
 			'page' => $this->title->getPrefixedText(),
-			'unreview' => $this->initial
+			'unreview' => $this->initial,
+			'token' => $this->user->getEditToken()
 		] );
 
 		$unReviewLink = Xml::element(
diff --git a/specials/SpecialPageStatistics.php b/specials/SpecialPageStatistics.php
index a7a6186..0c06048 100644
--- a/specials/SpecialPageStatistics.php
+++ b/specials/SpecialPageStatistics.php
@@ -39,6 +39,10 @@ public function execute( $parser = null ) {
 
 			$unReviewTimestamp = $wgRequest->getVal( 'unreview' );
 			if ( $unReviewTimestamp ) {
+				// state-changing GET action: require an edit token (CSRF protection)
+				if ( !$wgUser->matchEditToken( $wgRequest->getVal( 'token' ) ) ) {
+					throw new PermissionsError( 'editmywatchlist' );
+				}
 				$rh = new ReviewHandler( $wgUser, $this->mTitle, $wgRequest );
 				$rh->resetNotificationTimestamp( $unReviewTimestamp );
 				$wgOut->addModuleStyles( [ 'ext.watchanalytics.reviewhandler.styles' ] );