The WidgetPack Comment System plugin suffers from a missing nonce validation on the wpcmt_sync action within the wpcmt_request_handler function. This creates a CSRF flaw that allows an unauthenticated attacker to trigger comment synchronization on a WordPress site simply by causing a site administrator or other privileged user to visit a crafted link. The resulting action can add, modify, or delete comments without the user’s knowledge, potentially disrupting site content or facilitating spam.

All installations of the WidgetPack Comment System plugin up to and including version 1.6.1 are vulnerable. The flaw exists regardless of the underlying WordPress version; any site that has not upgraded beyond 1.6.1 is at risk.

The CVSS score of 4.3 indicates moderate severity. An EPSS score of less than 1% indicates that exploitation is currently deemed unlikely, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires the attacker to persuade a privileged user to click a malicious link, so the attack surface is limited to environments where such social engineering is feasible. The flaw does not provide remote code execution, though it does grant unauthorized manipulation of the comment sync feature.