CVE-2026-9730 describes a CSRF vulnerability in the Remove NoFollow Commenter URL plugin for WordPress. The issue arises from missing or incorrect nonce validation on the gmz_comment_settings_save function, which handles saving comment-display settings. Because of this, an attacker can craft a forged request that, when executed by an authenticated administrator (e.g., via clicking a link), modifies plugin settings without proper authorization. This vulnerability affects all versions up to and including 1.0 of the plugin. No official patch or remediation guidance is currently provided by the vendor or advisory sources.

An attacker can cause an authenticated administrator to unknowingly change the plugin's comment-display settings via a forged request. This results in an integrity impact on the plugin's configuration but does not affect confidentiality or availability. There is no indication of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links while logged into WordPress with administrative privileges and consider disabling or removing the plugin if possible.