The Comment Info Detector plugin for WordPress is vulnerable to Cross‑Site Request Forgery in all versions up to and including 1.0.5. The missing nonce validation on options.php allows an unauthenticated attacker to submit forged requests that change the plugin’s configuration. This breaks the integrity of the plugin’s settings and can lead to undesired behavior if the settings alter how comments are managed or displayed.

WordPress sites employing the tom_riddle Comment Info Detector plugin, with affected versions being any release 1.0.5 or earlier. All such installations are vulnerable regardless of other configurations.

The CVSS score of 4.3 reflects a moderate severity, while the EPSS score of < 1% indicates that the likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog, and no public zero‑day exploit has been reported. The attack most plausibly relies on a victim‑side interaction, such as tricking an administrator into clicking a malicious link that submits a forged request to options.php. Post‑attack, an attacker can modify settings but cannot execute code or read data beyond what the compromised settings might allow.