CVE-2026-4138: XSRF in DX Unanswered Comments WordPress Plugin

Successful exploitation of CVE-2026-4138 allows an attacker to forge requests that appear to originate from an authenticated administrator. This enables them to modify critical plugin settings, specifically dxucauthorslist and dxuccommentcount. An attacker could, for example, alter the list of authors tracked by the plugin, potentially masking malicious comments or manipulating reporting. While the impact is limited to the plugin's functionality, it could be leveraged to disrupt comment moderation workflows and potentially obscure malicious activity. The attack requires tricking a site administrator into clicking a malicious link, making social engineering a key component of exploitation.

1. Reserved2026-03-13
2. Published2026-04-21
3. Modified2026-04-25
4. EPSS updated2026-04-29

The primary mitigation for CVE-2026-4138 is to upgrade the DX Unanswered Comments plugin to a version that addresses the nonce validation issue. Unfortunately, a specific fixed version is not provided in the CVE details. As a temporary workaround, consider implementing strict Content Security Policy (CSP) rules to limit the sources from which the plugin can load resources. Additionally, carefully review any suspicious links or requests received via email or other channels to prevent accidental execution of forged requests. After upgrading, verify the plugin settings to ensure they haven't been tampered with.

Active installs

20

Plugin rating