What is the CVSS score of CVE-2026-9730?

CVE-2026-9730 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Remove NoFollow Commenter URL CVE-2026-9730

EUVD-2026-33896 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-02 Wordfence

GHSA-2qgv-chqp-r2q6

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 08:51 vuln.today

CVE Published

Jun 02, 2026 - 07:48 nvd

MEDIUM 4.3

DescriptionCVE.org

The Remove NoFollow Commenter URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the gmz_comment_settings_save function. This makes it possible for unauthenticated attackers to modify the plugin's comment-display setting via a forged request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the Remove NoFollow Commenter URL WordPress plugin (all versions ≤ 1.0) allows unauthenticated remote attackers to modify the plugin's comment-display settings by tricking a logged-in site administrator into clicking a crafted link. The vulnerability stems from absent or incorrect nonce validation in the gmz_comment_settings_save function, meaning the plugin accepts state-changing POST requests without verifying they originated from a legitimate admin session. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 (Medium) reflects the required user interaction as a meaningful limiting factor.

Technical ContextAI

WordPress plugins are expected to protect administrative settings-save actions using nonce tokens - short-lived, request-specific cryptographic values that WordPress generates and validates via wp_nonce_field() and check_admin_referer() or check_ajax_referer(). CWE-352 (Cross-Site Request Forgery) describes the root cause: the server-side handler gmz_comment_settings_save (confirmed at lines 24, 32, and 42 of gmzxnofollow.php per the Trac source references) processes form submissions without verifying a valid nonce, allowing any cross-origin HTTP request carrying a valid admin session cookie to modify settings. The affected CPE is cpe:2.3:a:jamesmuga:remove_nofollow_commenter_url:*:*:*:*:*:*:*:*, covering all published versions of the plugin through 1.0. The plugin's sole function is to strip nofollow attributes from commenter URL links, so the modified setting directly influences how commenter links are rendered to site visitors.

RemediationAI

No vendor-released patch identified at time of analysis - the only published version of the plugin is 1.0, which is confirmed vulnerable. WordPress site administrators running this plugin should consider deactivating and removing it until a patched version is released by the author, as this eliminates the attack surface entirely with no functional trade-off for sites that do not require nofollow stripping on commenter links. As a compensating control if deactivation is not feasible, administrators should enforce strict Content Security Policy headers and educate administrators to be cautious of unsolicited links, though this does not technically remediate the missing nonce. Monitor the Wordfence advisory page (https://www.wordfence.com/threat-intel/vulnerabilities/id/c47e170f-f51e-400a-97f3-4da034c193a9) and the WordPress plugin repository for an updated release that incorporates check_admin_referer() nonce validation in the gmz_comment_settings_save function.