CVE-2026-4138Disclosure

LOWCVSS 4.3 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The DX Unanswered Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce validation on the plugin's settings form in the dxuc-unanswered-comments-admin-page.php file. This makes it possible for unauthenticated attackers to modify plugin settings (dxuc_authors_list and dxuc_comment_count) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-352

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
3 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 2 mentions (2026-04-22); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

PoC

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-22	2	Disclosure2
2026-04-25	1	PoC1

Full discourse3 posts

Atomic Edge@atomicedgeWAF166d
PoC
https://atomicedge.io/cve-proof/cve-2026-4138-dx-unanswered-comments-version-1-7-medium-vulnerability-proof-of-concept CVE-2026-4138 #WordPress plugin #vulnerability dx-unanswered-comments #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
A link to a proof‑of‑concept for CVE‑2026‑4138 in the DX‑Unanswered‑Comments WordPress plugin is shared, with no exploitation, patch, or technical detail disclosed.
0000033
6 followersView on X
Infoflowcloud@infoflowcloud169d
Disclosure
🚨*CVE* CVE-2026-4138 The DX Unanswered Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce vali… https://www.cve.org/CVERecord?id=CVE-2026-4138 ----- Traducción: CVE-2026-4138 El … http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑4138, revealing a CSRF flaw in the DX Unanswered Comments WordPress plugin affecting all releases up to 1.7 due to missing nonce validation.
0000045
72 followersView on X
CVE@CVEnew169d
Disclosure
CVE-2026-4138 The DX Unanswered Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce vali… https://www.cve.org/CVERecord?id=CVE-2026-4138
Post summary
The DX Unanswered Comments WordPress plugin is vulnerable to Cross‑Site Request Forgery due to missing nonce checks in all versions up to 1.7; no PoC, exploit code, patch, or active exploitation details are provided.
00000285
57.2K followersView on X

Explore more

Back to dashboard