CVE-2026-6700: DX Sources WordPress Plugin CSRF Flaw

CVE-2026-6700 Overview

CVE-2026-6700 is a Cross-Site Request Forgery (CSRF) vulnerability in the DX Sources plugin for WordPress, affecting all versions up to and including 2.0.1. The flaw exists in the settings_page_build function due to missing or incorrect nonce validation. An unauthenticated attacker can craft a malicious request that, when triggered by a logged-in administrator (such as by clicking a link), modifies the plugin's configuration options without consent. The vulnerability is classified under CWE-352.

Critical Impact

Successful exploitation allows unauthorized modification of DX Sources plugin settings on affected WordPress sites, contingent on tricking an administrator into a single user interaction.

Affected Products

• DX Sources plugin for WordPress, all versions through 2.0.1
• WordPress sites with administrators who can be socially engineered into clicking attacker-controlled links
• Deployments where the plugin's settings.class.php lacks proper nonce verification

Discovery Timeline

• 2026-05-05 - CVE-2026-6700 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-6700

Vulnerability Analysis

The DX Sources plugin processes settings updates through the settings_page_build function defined in inc/settings.class.php. This function fails to validate a WordPress nonce before applying configuration changes. Without nonce validation, the server cannot distinguish between a legitimate administrator-submitted form and a request forged by a third party. An attacker hosts a page containing a crafted form or link targeting the WordPress admin endpoint. When an authenticated administrator visits the malicious page, the browser automatically attaches valid session cookies, and the server processes the forged request as authentic.

The attack requires user interaction (UI:R) and modifies plugin configuration, resulting in limited integrity impact without confidentiality or availability consequences.

Root Cause

The root cause is the absence of wp_verify_nonce or check_admin_referer validation in the settings handler. WordPress provides nonces specifically to bind administrative actions to a verified user session. The plugin code at lines 46 and 79 of settings.class.php accepts POST data and writes plugin options without confirming the request originated from an intentional administrator action.

Attack Vector

Exploitation occurs over the network with low complexity. The attacker prepares a webpage hosting a hidden form or auto-submitting JavaScript that targets the DX Sources settings endpoint. The attacker then delivers the page URL to an administrator through phishing, comment fields, or third-party site compromise. When the administrator clicks the link while authenticated to WordPress, the browser submits the forged request and the plugin applies attacker-chosen configuration values. No authentication credentials are required from the attacker because the victim's session supplies authorization.

No verified public exploit code is available. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Source Code for technical details on the affected function.

Detection Methods for CVE-2026-6700

Indicators of Compromise

• Unexpected modifications to DX Sources plugin settings appearing in the WordPress options table without corresponding administrator activity logs.
• HTTP POST requests to wp-admin/options-general.php or the DX Sources settings page lacking a valid _wpnonce parameter.
• Referer headers on settings update requests pointing to external, non-WordPress domains.
• Administrator browser history containing suspicious URLs immediately preceding plugin configuration changes.

Detection Strategies

• Monitor WordPress audit logs for plugin option changes and correlate timestamps with administrator login sessions and access patterns.
• Inspect web server access logs for POST requests to plugin admin endpoints originating from unexpected referrers or lacking nonce parameters.
• Deploy a Web Application Firewall (WAF) rule that flags state-changing POST requests to /wp-admin/ paths missing the _wpnonce field.

Monitoring Recommendations

• Enable a WordPress activity logging plugin to capture configuration changes with user attribution and source IP.
• Alert on outbound clicks from administrator workstations to recently registered or low-reputation domains.
• Track DX Sources plugin version installed across all managed WordPress instances and flag versions ≤ 2.0.1.

How to Mitigate CVE-2026-6700

Immediate Actions Required

• Identify all WordPress sites running the DX Sources plugin and verify the installed version against the vulnerable range (≤ 2.0.1).
• Disable the DX Sources plugin until a patched release is installed if administrators cannot avoid clicking external links during their workflow.
• Restrict WordPress administrator accounts to dedicated browser profiles or sessions that are not used for general web browsing.

Patch Information

At the time of publication, the Wordfence Vulnerability Report lists all versions through 2.0.1 as affected. Administrators should monitor the DX Sources plugin repository for an updated release that adds nonce validation to the settings_page_build function and apply it as soon as it is available.

Workarounds

• Deploy a WAF rule that rejects POST requests to DX Sources settings endpoints when a valid _wpnonce parameter is absent.
• Enforce SameSite=Strict or SameSite=Lax cookies on the WordPress session to limit cross-origin request forgery surface.
• Require administrators to log out of WordPress sessions when not actively performing site management tasks.
• Train administrative users to recognize phishing links and avoid clicking external URLs while authenticated to WordPress.

# Example ModSecurity rule to block CSRF attempts on WordPress admin POSTs lacking a nonce
SecRule REQUEST_METHOD "@streq POST" \
    "id:1006700,phase:2,chain,deny,status:403,\
    msg:'Possible CSRF: WordPress admin POST without _wpnonce'"
    SecRule REQUEST_URI "@contains /wp-admin/" "chain"
        SecRule &ARGS:_wpnonce "@eq 0"