The DX Unanswered Comments plugin for WordPress is vulnerable to Cross‑Site Request Forgery because a nonce is missing on its settings form. This flaw allows any unauthenticated user to send a forged request that changes the plugin’s configuration values such as dxuc_authors_list and dxuc_comment_count. The resulting change does not directly disclose user data, but it grants the attacker the ability to alter comment moderation behavior or display, effectively degrading the site’s integrity and potentially defacing content.

All installations of the DX Unanswered Comments plugin version 1.7 or earlier are affected. The flaw is present in the file dxuc‑unanswered‑comments‑admin‑page.php within the plugin package.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, so the current exploitation likelihood is unclear. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be an unauthenticated user crafting a CSRF request that a site administrator would inadvertently execute, usually via a malicious link or image. The lack of nonce validation makes the request trivial to trigger once admin credentials are presented.