This is a false alarm. Many “Security Programs” do that. That’s called FUD.
WordPress does not check the Referer header, because it is often empty, and real spammers send the site URL as Referer anyway.
But all comment field are sanitized, so no harmful code will be injected. Install an anti-spam plugin, and everything is fine. This report is obviously bogus.
Related Posts:
- comment_post_ID 0 (cannot remove from dashboard)
- Why do I get accidental comments without (the required) email address?
- How to Block Access to Standard Login Flow and Comment Flow
- Strategies for coping with hyperagressive spambots?
- Sanitizing comments or escaping comment_text()
- wp_insert_comment and security
- Admin can enter JavaScript – potential security risk?
- reCaptcha doesnt appear in comment (manual or plugin)
- WordPress scruity issue – Totally disable all comments by CSS — secure enough?
- How are readers authenticated for leaving comments?
- WordPress Commenting System User access and Security
- comments reply script not working
- What should I do to make generated avatars different for anonymous comments?
- Check If comment author is registered
- How do I set up real anonymous posting in bbpress forums? [closed]
- How do I turn off wordpress comments ability to capture a users ip address?
- Success message in comment form
- How to allow the reply link to remain on the comment form after I have reached my 10 nested comment limit?
- How to remove commenters ability to add hyperlinks to comments?
- Is there a hook for comment author link?
- Exclude internal links from comment moderation?
- Change the HTML output of comments
- Can’t add default comments to custom post type
- Upload images with comment
- Prevent Contributor to show comment list
- where to modify get_comment_author_link()?
- Change language of comments template
- Why Allow Script Commands in Comments?
- How to enable comments options?
- WordPress comment count to include attachment comments
- How to no follow the paginated comments
- Remove “Comments are closed” Notice from Custom Post Type template
- Comment count wrong with orphaned comments
- Comment form problem with comment_author_url and HTML5 input placeholders
- Get comment content by comment ID
- Pings and replies
- Retrieve comments from current post using SQL
- Comment_Reply_Link Not Showing?
- Display recent comments with gravatar and excerpts?
- Sync comment data
- Comment displaying full name even after setting another display name?
- How to move comments box above comments
- save_post action hook for comments
- Ability to leave comments broken
- How to disable comment flood temporarily in a single scope
- How to create a seperate commenting system?
- Change how many approved comments must user have
- Only admin can see comments on post or page
- Count comment threads, not total comments in a post
- Show comments of a user post only when they are login
- Display Custom comments field number
- How to get and use the the number of days since the last comment?
- Trying to post a wordpress comment on my site redirects to 127.0.0.1
- Best way to tell if a comment is from a user?
- How can get comment link by comment id?
- How to amend time format of comments, using child-theme?
- Make user’s name display as the site name in comments if it matches certain roles
- Display avatar with comment form?
- Adding SQL source code to comments
- How to control size of comments popup window?
- How to make comments private for commentor and post author
- Name of comment field differs on different sites
- Sent comments notifications to multiple users
- Applying same style to all the comments on the page
- Customise Comment form
- assumed as comment line
- How / where is the wp_query object created for RSS feeds?
- Separate page for comments using permalinks and add_rewrite_rule
- Return count for characters in the comment and perform action based on the length
- How to load new posts from wordpress db into wordpress homepage without refreshing the site?
- Delete/Spam Comment Button
- Who approved a comment, to show up in dashboard
- comments.php remove date/time’s #hyperlink
- comment just attachment .. reply just text … can I do that?
- How to make email field not required in comments?
- How to prevent users/authors from seing IP/email of new commentators?
- Why are my threaded comments not quite working? [closed]
- I want to limit registered user to 1 comment per post in WordPress
- edit comments in front end
- How to replace anonymous comment form with a registration form on wordpress?
- What is wrong with this? [closed]
- Comment moderation
- I have tried using Plugins to remove 72K comments with no success
- How to get the 5 most recent comments and each comment 5 most recent replies (children)
- Comment text area in single blog post and show comments if approved
- comment files and s
- How to ‘If Author’ Comments Check
- selectively disable akismet
- Disqus moderation page not working in WordPress admin section
- Comment Blacklist
- Comment forum to display under the comment you’re replying too
- Recent comments per tagged post?
- Subscribe to a post’s comments without posting a comment yourself
- Modify “Recent Comments” List in WP-Admin
- Comment submission & navigation redirects to default language
- How to hide the login / profile urls on top of comment box for a post
- wp_list_comments adds unnecessary elements
- Why default comment fields don’t show up?
- How can I filter the user avatar displayed in comments? – get_avatar_url filter works everywhere but not in comments
- WordPress Editor widgets “comments” and “post comments form” getting disappeared with elementor [closed]