The DX Sources plugin contains a CSRF flaw caused by missing or incorrect nonce validation in the settings_page_build function. This flaw allows an unauthenticated attacker to trick a logged‑in administrator into submitting a forged request that changes the plugin’s configuration, potentially altering site behavior or enabling further exploitation.

The vulnerability affects the xavortm DX Sources plugin for WordPress, all versions up to and including 2.0.1. Users running any of these versions should verify the installed version and consider upgrading.

The CVSS score of 4.3 indicates a low severity, and the EPSS score is not available, so the likelihood of exploitation is uncertain. The flaw is not listed in CISA KEV. The attack requires an administrator to click a malicious link or submit a forged form, making the vector user interaction – a typical CSRF scenario.