The WP Responsive Popup + Optin plugin for WordPress suffers from a CSRF vulnerability due to missing nonce protection on its admin settings form (wpo_admin_page.php). Without wp_nonce_field and wp_verify_nonce or check_admin_referer functions, attackers can craft malicious requests that, if executed by an authenticated administrator, allow modification of all plugin settings. This affects all versions up to and including 1.4. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

An attacker can exploit this vulnerability by tricking a site administrator into performing an action such as clicking a crafted link, resulting in unauthorized changes to the plugin's settings. This could lead to manipulation of the 'wpo_image_url' parameter and potentially other configuration values, impacting the plugin's behavior and possibly the site's content display. There is no indication of direct impact on availability or full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid interacting with untrusted links or requests while logged into the WordPress admin interface. Monitoring for updates from the plugin developer or WordPress security channels is recommended to apply any forthcoming patches promptly.