CVE-2026-6700 is a CSRF vulnerability in the xavortm DX Sources WordPress plugin affecting all versions up to 2.0.1. The issue arises from missing or incorrect nonce validation on the settings_page_build function, enabling an attacker to coerce an authenticated administrator into unknowingly submitting a malicious request that changes plugin settings. The vulnerability requires user interaction (UI:R) and does not allow direct confidentiality or availability impact but can cause integrity loss by unauthorized configuration changes.

An attacker can cause a logged-in administrator to unknowingly modify the plugin's configuration via a forged request. This impacts the integrity of the plugin settings but does not affect confidentiality or availability. The attack requires the administrator to interact with a crafted link or request, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when clicking on untrusted links while logged into WordPress with administrative privileges. Monitoring vendor channels for updates is recommended.