CVE-2026-4138 is a CSRF vulnerability in the DX Unanswered Comments plugin for WordPress, affecting all versions up to 1.7. The issue arises from the absence of nonce validation in the dxuc-unanswered-comments-admin-page.php file's settings form, enabling attackers to forge requests that modify plugin settings such as dxuc_authors_list and dxuc_comment_count. Exploitation requires tricking an authenticated site administrator into performing an action like clicking a crafted link. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). No patch or official fix has been disclosed as of the publication date.

An attacker can cause unauthorized modification of plugin settings by exploiting the CSRF vulnerability, potentially altering how the plugin behaves or displays content. There is no direct impact on confidentiality or availability, but integrity of plugin configuration can be compromised. Exploitation requires user interaction from an administrator, limiting the attack scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links while logged into the WordPress admin interface. Monitoring for updates from the plugin vendor or WordPress security channels is recommended to apply any forthcoming patches promptly.