CVE-2026-9730
Cross-Site Request Forgery in Remove NoFollow Commenter URL WordPress Plugin
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| remove_nofollow_commenter_url | plugin | to 1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Remove NoFollow Commenter URL plugin for WordPress has a vulnerability known as Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0.
This vulnerability exists because the plugin's gmz_comment_settings_save function lacks proper nonce validation, which is a security measure to verify legitimate requests.
As a result, an unauthenticated attacker can trick a site administrator into performing an action, such as clicking a malicious link, which then allows the attacker to modify the plugin's comment-display settings without authorization.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability exists due to missing or incorrect nonce validation in the Remove NoFollow Commenter URL plugin for WordPress up to version 1.0, allowing unauthenticated attackers to modify comment-display settings via forged requests.
Immediate mitigation steps include updating the plugin to a version that fixes the nonce validation issue once available, or temporarily disabling the plugin to prevent exploitation.
Additionally, educating site administrators to avoid clicking on suspicious links can reduce the risk of exploitation.
How can this vulnerability impact me? :
This vulnerability allows an attacker to change the comment-display settings of the Remove NoFollow Commenter URL plugin without proper authorization.
While it does not directly compromise confidentiality or availability, it can lead to unauthorized changes in how comments are displayed on your WordPress site.
Such unauthorized modifications could potentially affect site behavior or user experience, and might be leveraged as part of a larger attack.