CVE-2026-9730

An unauthenticated attacker can exploit this vulnerability by tricking a site administrator into clicking a malicious link. This link would trigger a forged request to the gmz_comment_settings_save function, allowing the attacker to modify the plugin's comment-display setting. The vulnerability is present because the function does not correctly validate nonces, which are intended to prevent such forged requests [ref_id=1].

The vulnerability resides in the gmz_comment_settings_save function within the gmzxnofollow.php file. This function is responsible for saving comment settings and is susceptible to CSRF attacks due to insufficient nonce validation [ref_id=1].

The patch is not provided in the bundle. The advisory indicates that the vulnerability is due to missing or incorrect nonce validation in the gmz_comment_settings_save function. Remediation would involve implementing proper nonce checks before processing user input to prevent unauthorized modifications.