The AJAX Report Comments plugin for WordPress fails to validate nonces in the rc_options_page function, creating a Cross‑Site Request Forgery vulnerability. An attacker who can convince an administrator to click a malicious link can modify any plugin setting. Changes include link text and markup, success or failure messages, comment thresholds, cookie durations, reporter‑comment toggles, and notification email addresses and bodies. This allows an attacker to alter the user experience, redirect notifications, or enable unintended content without authentication.

Tierrain Innovation’s AJAX Report Comments plugin, versions 2.0.4 and earlier. All WordPress installations that have not updated beyond 2.0.4 are affected.

The CVSS Base score of 4.3 indicates moderate severity, while the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting an uncertain exploitation frequency. The CSRF attack requires only a crafted URL or link presented to an administrator; no user credentials are needed. A successful forgery results in unauthorized configuration changes that may disrupt site functionality or compromise email notifications.