Remove Nofollow Commenter Url
Monthly
Cross-Site Request Forgery in the Remove NoFollow Commenter URL WordPress plugin (all versions ≤ 1.0) allows unauthenticated remote attackers to modify the plugin's comment-display settings by tricking a logged-in site administrator into clicking a crafted link. The vulnerability stems from absent or incorrect nonce validation in the `gmz_comment_settings_save` function, meaning the plugin accepts state-changing POST requests without verifying they originated from a legitimate admin session. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 (Medium) reflects the required user interaction as a meaningful limiting factor.
Cross-Site Request Forgery in the Remove NoFollow Commenter URL WordPress plugin (all versions ≤ 1.0) allows unauthenticated remote attackers to modify the plugin's comment-display settings by tricking a logged-in site administrator into clicking a crafted link. The vulnerability stems from absent or incorrect nonce validation in the `gmz_comment_settings_save` function, meaning the plugin accepts state-changing POST requests without verifying they originated from a legitimate admin session. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 (Medium) reflects the required user interaction as a meaningful limiting factor.