CVE-2026-4138 identifies a CSRF vulnerability in the DX Unanswered Comments plugin for WordPress, affecting all versions up to 1.7. The root cause is the absence of nonce validation in the dxuc-unanswered-comments-admin-page.php file's settings form, which enables attackers to forge requests that change plugin settings (dxuc_authors_list and dxuc_comment_count) if an administrator is tricked into executing the request. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and impact limited to integrity.

An attacker can cause unauthorized changes to the plugin's settings by exploiting the CSRF vulnerability, potentially altering how the plugin behaves or displays information. There is no direct impact on confidentiality or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — no official fix or patch is currently available. Administrators should monitor the vendor's advisory for updates. Until a patch is released, limiting administrative access and educating administrators to avoid clicking untrusted links can reduce risk.