CVE-2026-9730 is a CSRF vulnerability in the Remove NoFollow Commenter URL plugin for WordPress, affecting all versions up to and including 1.0. The issue arises from missing or incorrect nonce validation in the gmz_comment_settings_save function, enabling attackers to forge requests that modify plugin settings without authentication if an administrator is tricked into executing the action. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) with an attack vector of network, low attack complexity, no privileges required, user interaction required, and limited impact on integrity only.

An attacker can cause an authenticated administrator to unknowingly change the plugin's comment-display settings via a forged request. This could lead to unintended configuration changes but does not directly compromise confidentiality or availability. There are no known exploits in the wild. The impact is limited to integrity modification of plugin settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin author or WordPress security advisories is recommended.