Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The WP Responsive Popup + Optin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.4. This is due to the settings form on the admin page (wpo_admin_page.php) lacking nonce generation (wp_nonce_field) and verification (wp_verify_nonce/check_admin_referer). This makes it possible for unauthenticated attackers to update all plugin settings including the 'wpo_image_url' parameter via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-22 | 1 | Disclosure1 |
| 2026-04-23 | 2 | Disclosure1PoC1 |
https://atomicedge.io/cve-proof/cve-2026-4131-wp-popup-optin-version-1-4-medium-vulnerability-proof-of-concept CVE-2026-4131 #WordPress plugin #vulnerability wp-popup-optin #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
A proof of concept for CVE‑2026‑4131 affecting the wp-popup-optin plugin has been made publicly available.
CVE-2026-4131 The WP Responsive Popup + Optin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.4. This is due to the settings fo… https://www.cve.org/CVERecord?id=CVE-2026-4131
Post summary
CVE-2026-4131 reveals a CSRF flaw in WP Responsive Popup + Optin plugin versions up to 1.4, with no PoC, exploit, patch or active exploitation details provided.
CVE-2026-4131 Cross-Site Request Forgery in WP Responsive Popup + Optin Plugin Versions Up to 1.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4131
Post summary
CVE-2026-4131 exposes a cross‑site request forgery flaw in WP Responsive Popup + Optin Plugin versions up to 1.4, with no mention of active exploitation, patch, or PoC.