PT-2026-34292 · Sphex1987 · Wp Responsive Popup + Optin

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-4131

Mitre

CVSS v3.1

6.1

Medium

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The WP Responsive Popup + Optin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.4. This is due to the settings form on the admin page (wpo admin page.php) lacking nonce generation (wp nonce field) and verification (wp verify nonce/check admin referer). This makes it possible for unauthenticated attackers to update all plugin settings including the 'wpo image url' parameter via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-4131

Affected Products

Wp Responsive Popup + Optin

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-4131 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-popup-optin/tags/1.4/wpo_admin_page.php#L43 · Note
• https://plugins.trac.wordpress.org/browser/wp-popup-optin/trunk/wpo_admin_page.php#L43 · Note
• https://plugins.trac.wordpress.org/browser/wp-popup-optin/trunk/wp-popup-optin.php#L218 · Note
• https://plugins.trac.wordpress.org/browser/wp-popup-optin/trunk/wpo_admin_page.php#L104 · Note
• https://plugins.trac.wordpress.org/browser/wp-popup-optin/tags/1.4/wpo_admin_page.php#L103 · Note
• https://plugins.trac.wordpress.org/browser/wp-popup-optin/trunk/wpo_admin_page.php#L103 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0a8a49c4-21e8-447c-94da-8241c7d66c29?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-popup-optin/tags/1.4/wpo_admin_page.php#L104 · Note
• https://plugins.trac.wordpress.org/browser/wp-popup-optin/tags/1.4/wp-popup-optin.php#L218 · Note
• https://plugins.trac.wordpress.org/browser/wp-popup-optin/tags/1.4/wpo_admin_page.php#L15 · Note
• https://plugins.trac.wordpress.org/browser/wp-popup-optin/trunk/wpo_admin_page.php#L15 · Note