What is the CVSS score of CVE-2026-4131?

CVE-2026-4131 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WP Responsive Popup + Optin CVE-2026-4131

EUVD-2026-24672 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-22 Wordfence

GHSA-mjqc-rj22-4rf2

PHP CSRF WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:00 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24672

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 6.1

DescriptionCVE.org

The WP Responsive Popup + Optin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.4. This is due to the settings form on the admin page (wpo_admin_page.php) lacking nonce generation (wp_nonce_field) and verification (wp_verify_nonce/check_admin_referer). This makes it possible for unauthenticated attackers to update all plugin settings including the 'wpo_image_url' parameter via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.

AnalysisAI

WP Responsive Popup + Optin plugin for WordPress versions up to 1.4 is vulnerable to Cross-Site Request Forgery (CSRF) allowing unauthenticated attackers to modify all plugin settings, including the 'wpo_image_url' parameter, by tricking site administrators into clicking a malicious link. The vulnerability exists because the settings form in wpo_admin_page.php lacks WordPress nonce generation and verification functions. Exploitation requires administrator interaction but can alter critical plugin configuration with broader impact across the site.

Technical ContextAI

The vulnerability stems from missing CSRF protection mechanisms in the WordPress admin settings handler. WordPress provides two primary nonce-based CSRF mitigation functions: wp_nonce_field() for form output and wp_verify_nonce()/check_admin_referer() for validation. The affected plugin omits both, meaning the settings form at wpo_admin_page.php processes POST requests without cryptographic token verification. This is classified under CWE-352 (Cross-Site Request Forgery), a foundational web security weakness. The plugin is built for WordPress, a PHP-based content management system where admin functionality is privileged but delegated to authenticated users. An attacker can craft a cross-site POST request targeting the plugin's settings endpoint, relying on the fact that the administrator's WordPress session cookie will be automatically included by the browser.

RemediationAI

The primary remediation is to upgrade to a patched version released by the plugin developer after 1.4. Site administrators should immediately check for plugin updates in the WordPress admin dashboard (Plugins → Updates). If a patched version is available, update to the latest release; the fix will involve adding wp_nonce_field() to the settings form output and wp_verify_nonce() or check_admin_referer() to the form processing logic in wpo_admin_page.php. If no patch is available from the vendor, disable the plugin until a fix is released, as the CSRF vulnerability allows unauthorized configuration changes. As a temporary workaround with trade-offs, implement WordPress user role restrictions by ensuring only Site Administrator (not Editor or lower roles) can access plugin settings via role-based capability checks, though this does not mitigate CSRF from compromised admin accounts or cross-site attacks. Additionally, deploy a Web Application Firewall (WAF) rule to detect and block POST requests to the plugin's admin handler that lack valid nonce parameters, with the trade-off that legitimate requests with misconfigured nonces may be blocked. For vendors still using this plugin, contact sphex1987 or monitor the plugin repository for security updates.