Is CVE-2026-9730 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9730 being exploited in the wild.

How severe is CVE-2026-9730?

Medium severity, with a CVSS score of 4.3, published 2 June 2026.

Which products and versions are affected?

Remove NoFollow Commenter URL Up to, and including, 1.0.

Is there a fix for CVE-2026-9730?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9730 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9730?

Check whether you run Remove NoFollow Commenter URL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9730: WordPress Remove NoFollow Commenter URL CSRF in gmz_comment_settings_save

CVE-2026-9730 · Severity: medium · CVSS 4.3 · Published 2026-06-02

The Remove NoFollow Commenter URL plugin for WordPress, which manages how links in comments are handled for SEO purposes, is vulnerable to a security flaw that allows unauthorized changes to its settings. By tricking a site administrator into clicking a malicious link, an attacker can remotely modify the plugin's comment-display configuration. This could impact how the site handles external links and potentially affect the site's search engine optimization or comment moderation workflow.

Quick answers

Is CVE-2026-9730 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9730 being exploited in the wild.
How severe is CVE-2026-9730?: Medium severity, with a CVSS score of 4.3, published 2 June 2026.
Which products and versions are affected?: Remove NoFollow Commenter URL Up to, and including, 1.0.
Is there a fix for CVE-2026-9730?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9730 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9730?: Check whether you run Remove NoFollow Commenter URL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Remove NoFollow Commenter URL plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the gmz_comment_settings_save function. An unauthenticated attacker can exploit this by inducing a site administrator to perform an action, such as clicking a crafted link, while authenticated to the WordPress dashboard. Successful exploitation allows the attacker to modify the plugin's comment-display settings. The vulnerability exists in all versions up to and including 1.0. No patch has been confirmed in the provided advisory.

Affected products

WordPress Plugin Remove NoFollow Commenter URL Up to, and including, 1.0

Timeline

2026-06-02: advisory: Initial disclosure by Wordfence and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.