CVE-2026-9730: WordPress Remove NoFollow Commenter CSRF

CVE-2026-9730 Overview

CVE-2026-9730 affects the Remove NoFollow Commenter URL plugin for WordPress in all versions up to and including 1.0. The vulnerability is a Cross-Site Request Forgery (CSRF) flaw caused by missing or incorrect nonce validation in the gmz_comment_settings_save function. Unauthenticated attackers can modify the plugin's comment-display setting by tricking an authenticated site administrator into clicking a crafted link. The issue is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact

Successful exploitation lets remote attackers alter plugin configuration that controls how commenter URLs are rendered, weakening site link policies through a single administrator click.

Affected Products

• Remove NoFollow Commenter URL plugin for WordPress — all versions through 1.0
• WordPress sites with the affected plugin installed and activated
• Administrator accounts authenticated to the WordPress admin dashboard

Discovery Timeline

• 2026-06-02 - CVE-2026-9730 published to NVD
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-9730

Vulnerability Analysis

The Remove NoFollow Commenter URL plugin exposes a settings save handler that processes administrator requests without verifying a valid WordPress nonce. WordPress nonces are single-use tokens designed to bind state-changing requests to an authenticated session, preventing third-party origins from forging those requests. Because the gmz_comment_settings_save function does not call check_admin_referer() or wp_verify_nonce() before persisting submitted settings, any HTTP request that reaches the handler while an administrator is logged in is treated as authentic. An attacker hosts a page containing an auto-submitting form or image tag targeting the plugin's settings endpoint, then lures the administrator to visit it. The browser sends the administrator's session cookies along with the forged request, and the plugin writes the attacker-controlled value. The CWE-352 category captures this class of state-changing request without anti-CSRF protection.

Root Cause

The root cause is missing server-side nonce validation in the gmz_comment_settings_save function within gmzxnofollow.php. The handler accepts POST data and updates plugin options without confirming that the request originated from the WordPress admin interface.

Attack Vector

Exploitation requires user interaction from a logged-in administrator, such as clicking an attacker-supplied link or visiting a malicious page. The request is delivered over the network and requires no authentication on the attacker's side. The vulnerability impacts integrity by allowing modification of the comment-display configuration, while confidentiality and availability are not directly affected. Technical detail is available in the Wordfence Vulnerability Report and the WordPress plugin source code.

Detection Methods for CVE-2026-9730

Indicators of Compromise

• Unexpected changes to Remove NoFollow Commenter URL plugin settings stored in the wp_options table.
• Administrator browser sessions showing POST requests to the plugin settings endpoint originating from external Referer headers.
• Comment output on the site suddenly rendering commenter URLs without the expected rel="nofollow" attribute, or vice versa.

Detection Strategies

• Inspect web server access logs for POST requests to wp-admin endpoints that include the plugin's settings parameters but lack an internal Referer.
• Audit the wp_options table for unexpected modifications to keys created by the plugin.
• Use a web application firewall ruleset that flags state-changing WordPress admin requests missing a valid _wpnonce parameter.

Monitoring Recommendations

• Enable WordPress audit logging to record administrator setting changes with timestamps and source IP addresses.
• Alert on anomalous administrator browsing patterns, including off-hours visits to external domains immediately preceding configuration changes.
• Monitor the WordPress plugin directory for updated releases of remove-nofollow-commenter-link and subscribe to the Wordfence threat intelligence feed.

How to Mitigate CVE-2026-9730

Immediate Actions Required

• Deactivate and remove the Remove NoFollow Commenter URL plugin until a patched version is available.
• Restrict administrator browsing on the workstation used to manage WordPress, avoiding untrusted links while authenticated.
• Review plugin settings and recent comment rendering output to confirm no unauthorized changes have taken effect.

Patch Information

No vendor patch is referenced in the available CVE data. Administrators should monitor the WordPress plugin repository for a release that introduces nonce validation in the gmz_comment_settings_save function and apply it once published.

Workarounds

• Remove the plugin and replace its functionality with a maintained alternative that implements check_admin_referer() on all setting handlers.
• Deploy a web application firewall rule that blocks POST requests to the plugin's settings endpoint when a valid WordPress nonce is absent.
• Enforce two-step session controls so administrators authenticate in a dedicated browser profile that does not visit untrusted sites.

# Example WordPress CLI commands to disable and remove the vulnerable plugin
wp plugin deactivate remove-nofollow-commenter-link
wp plugin delete remove-nofollow-commenter-link
wp option get gmz_comment_settings