CVE-2026-6700 is a CSRF vulnerability in the xavortm DX Sources WordPress plugin affecting all versions up to 2.0.1. The issue arises from missing or incorrect nonce validation in the settings_page_build function, enabling attackers to forge requests that modify plugin settings if an authenticated administrator is tricked into performing an action. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) with an attack vector of network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No patch or official remediation is currently documented.

An attacker can cause a logged-in administrator to unknowingly change plugin configuration settings via a forged request. This could lead to unauthorized modification of plugin behavior but does not directly impact confidentiality or availability. The vulnerability requires user interaction and an authenticated administrator session, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Implementing additional CSRF protections or nonce validation in the plugin code may mitigate the risk if custom development is possible.