What is the CVSS score of CVE-2026-4138?

CVE-2026-4138 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

DX Unanswered Comments CVE-2026-4138

EUVD-2026-24678 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-22 Wordfence

PHP CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:03 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24678

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 4.3

DescriptionCVE.org

The DX Unanswered Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce validation on the plugin's settings form in the dxuc-unanswered-comments-admin-page.php file. This makes it possible for unauthenticated attackers to modify plugin settings (dxuc_authors_list and dxuc_comment_count) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery (CSRF) in the DX Unanswered Comments WordPress plugin versions up to 1.7 allows unauthenticated attackers to modify critical plugin settings (authors list and comment count) by tricking a site administrator into clicking a malicious link, due to missing nonce validation in the settings form handler. The CVSS 4.3 score reflects low severity with integrity impact limited to plugin configuration rather than data or code execution, but successful exploitation could alter site functionality if an attacker controls which comments are flagged as unanswered.

Technical ContextAI

The vulnerability exists in the dxuc-unanswered-comments-admin-page.php file, the primary settings interface for this WordPress plugin. The root cause is a missing CSRF token (WordPress nonce) validation on form submission, classified under CWE-352 (Cross-Site Request Forgery). WordPress plugins are meant to use wp_verify_nonce() and wp_nonce_field() to prevent CSRF attacks on admin actions. The affected CPE is cpe:2.3:a:nofearinc:dx_unanswered_comments, indicating all versions of the plugin published under this vendor identifier. The forged request mechanism exploits the trust relationship between a logged-in administrator and their browser; if that administrator visits a malicious webpage while logged into WordPress, the attacker can submit forms to modify settings without the administrator's knowledge or consent.

RemediationAI

The primary mitigation is to update the DX Unanswered Comments plugin to a version newer than 1.7 that includes nonce validation on the admin settings form. Site administrators should check the WordPress plugins dashboard for available updates and apply them immediately. If a patched version is not yet available in the repository, temporarily disable the plugin via wp-admin or command line (wp plugin deactivate dx-unanswered-comments) until a fix is released. As a compensating control, restrict access to the plugin settings page (wp-admin/admin.php?page=dxuc_settings) by IP allowlist at the web server or WAF level, limiting which network addresses can submit POST requests to the admin interface-this prevents external attackers from crafting CSRF requests even if administrators visit malicious sites, though it may inconvenience remote administrators. Site administrators should also educate users (especially other admins) not to click untrusted links while logged into WordPress, as CSRF attacks depend on this social engineering vector.