The Remove NoFollow Commenter URL plugin for WordPress is vulnerable to Cross‑Site Request Forgery (CWE‑352) because the gmz_comment_settings_save function lacks proper nonce validation. An attacker can construct a forged request that, if an authenticated site administrator clicks a malicious link, will silently change the plugin's comment‑display setting. The vulnerability can be exploited by unauthenticated attackers with the ability to trick an admin into visiting such a link.

The vulnerability affects the Remove NoFollow Commenter URL WordPress plugin (author James Muga) in versions 1.0 and earlier. Any site running the plugin at or below this version is considered vulnerable.

With a CVSS score of 4.3, the risk is low‑to‑medium; the exploit requires no special privileges and only the ability to lure a logged‑in administrator to a crafted link. The flaw is not listed in CISA KEV and the EPSS score is unavailable, indicating no known widespread exploitation yet, but the absence of nonce protection makes the attack trivial if a target is chosen.