What is the CVSS score of CVE-2026-6700?

CVE-2026-6700 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

DX Sources WordPress Plugin CVE-2026-6700

EUVD-2026-27203 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-05 Wordfence

GHSA-gh5g-gr5m-vq9w

CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 03:31 vuln.today

DescriptionCVE.org

The DX Sources plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.1. This is due to missing or incorrect nonce validation on the settings_page_build function. This makes it possible for unauthenticated attackers to trick a logged-in administrator into submitting a forged request that modifies the plugin's configuration options via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery (CSRF) in DX Sources plugin for WordPress up to version 2.0.1 allows unauthenticated attackers to modify plugin configuration options by tricking a logged-in administrator into clicking a malicious link. The vulnerability stems from missing nonce validation in the settings_page_build function, enabling attackers to alter plugin settings without administrative consent. No active exploitation has been confirmed at the time of analysis.

Technical ContextAI

DX Sources is a WordPress plugin that handles source configuration management. The vulnerability resides in the settings_page_build function within the plugin's settings class (inc/settings.class.php), which processes administrative configuration changes without proper Cross-Site Request Forgery (CSRF) token validation. WordPress uses nonces - cryptographic tokens tied to user sessions and actions - as the standard defense against CSRF attacks. The absence or incorrect implementation of nonce verification in this handler means the plugin processes POST/GET requests from any origin without confirming they originated from the legitimate WordPress admin interface. CWE-352 (Cross-Site Request Forgery) classifies this as an improper verification of the source and authenticity of user-supplied input. The CPE string (cpe:2.3:a:xavortm:dx_sources:*:*:*:*:*:*:*:*) indicates all versions across all patch levels are affected.

RemediationAI

Update the DX Sources plugin to a patched version if available from the author xavortm through the WordPress plugin repository. If no newer version has been released, the immediate workaround is to implement nonce validation in the settings_page_build function by adding wp_verify_nonce() checks before processing any settings modifications. Administrators should review and re-verify all plugin configuration settings to detect any unauthorized changes, and consider temporarily disabling the DX Sources plugin until a patch is confirmed. For additional protection, restrict WordPress admin dashboard access via firewall rules (limiting to known IP ranges), enforce strong administrator passwords, and educate site administrators about not clicking links from untrusted sources while logged into the admin panel. The Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c96e57-0300-4ea7-a0c6-5d060b6e979d?source=cve contains timeline and remediation details.