The AMP for WP – Accelerated Mobile Pages plugin contains a logic error that inverts nonce validation in the new comments AJAX handler. Valid nonces are rejected while missing or invalid nonces are accepted. This flaw enables unauthenticated attackers to forge comment submissions on behalf of logged‑in users via a simple browser request, provided the victim is tricked into visiting a crafted link and the plugin’s template mode is active. The vulnerability does not give direct code execution or data exfiltration but allows attackers to inject arbitrary comments, potentially spread spam or phishing links, and degrade user trust. The weakness is a classic Cross‑Site Request Forgery (CWE‑352).

WordPress sites running the AMP for WP – Accelerated Mobile Pages plugin, versions 1.1.9 or earlier, with template mode enabled. The issue was discovered in the PHP file amp_theme_ajaxcomments and requires the plugin to be updated to a version newer than 1.1.9 to remove the inverted nonce logic.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% shows a very low likelihood of exploitation at the moment. The vulnerability is not listed in the CISA KEV catalog. Attack readiness requires an unauthenticated user to lure an authenticated visitor to a forged request; therefore, realistic attackers would likely need social engineering or a compromised site. Given the low exploitation probability, the risk to a site with strict user moderation may be moderate but could be higher where comment spam tolerance is low.