Ayesh Karunaratne

WordPress has a 12-year-old unfixed security vulnerability that it does not properly validate incoming comments.
An attacker can trick both anonymous and logged-in users to post comments on a victim site without them realizing, while using their own credentials.
See this issue for more information: https://core.trac.wordpress.org/ticket/10931
This is a tiny (fewer than 40 effect lines of code) module that adds a secure token to the comment form and validate it before accepting any comment, thus making your comment forms secure as they should\’ve been for all these years!
It provides no UI – just install it, and you are all set!
<ol>
<li>This plugin adds a secret cryptographically-secure token to the comment form. This is a unique value and is computationally impractical to guess it.</li>
<li>Upon comment submission, the comment is rejected if the secret tokens are not present or computationally invalid.</li>
</ol>

Comment Form CSRF Protection

Prevent Cross-Site Request Forgery attacks on your comments form.

Julio Potier

The <a href="http://en.wikipedia.org/wiki/Cross-site_request_forgery" rel="nofollow ugc">CSRF</a> vulnerability is the most famous web vulnerability, since … i do not remember, too long !
Many WordPress plugin (about 70%) from this repository or elsewhere, even Premim plugins are vunerable to this flaw.
To avoid get hacked because os this, just install this plugin, no settings, no tech. Just use your blog as usual.
! ONLY FOR BACK-END USAGE !

Anti CSRF

The CSRF vulnerability is the most famous web vulnerability, since ... i do not remember, too long !

Comment Form CSRF Protection vs Anti CSRF