CVE-2026-6700 — The DX Sources plugin for WordPress is vulnerable to

title: WordPress DX Sources Plugin CSRF - Settings Modification Attempt - CVE-2026-6700
id: scw-2026-05-05-ai-1
status: experimental
level: medium
description: |
  Detects attempts to exploit CVE-2026-6700 by targeting the settings_page_build function in the DX Sources WordPress plugin. This rule looks for POST requests to the general options page that include parameters indicative of modifying DX Sources settings, specifically when nonce validation is bypassed or absent. This is a direct indicator of a CSRF attack attempting to alter plugin configuration.
author: SCW Feed Engine (AI-generated)
date: 2026-05-05
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6700/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/options-general.php'
      cs-method:
          - 'POST'
      cs-uri-query|contains:
          - 'page=dx_sources_settings'
  selection_nonce_check:
      cs-uri-query|contains:
          - 'action=save'
  condition: selection AND selection_nonce_check
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse