CVE-2026-4131 is a CSRF vulnerability in the WP Responsive Popup + Optin WordPress plugin (up to version 1.4). The issue stems from the absence of nonce protection on the plugin's admin settings form (wpo_admin_page.php), specifically missing wp_nonce_field generation and wp_verify_nonce or check_admin_referer verification. This allows unauthenticated attackers to craft requests that, if executed by an administrator, can update all plugin settings, including the 'wpo_image_url' parameter. The vulnerability is network exploitable without privileges but requires user interaction (administrator clicking a malicious link).

Successful exploitation allows an attacker to modify all plugin settings without authentication, potentially altering the plugin's behavior or content displayed via the 'wpo_image_url' parameter. This could lead to limited confidentiality and integrity impacts within the WordPress environment. There is no impact on availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking untrusted links and consider restricting access to the plugin's admin settings page. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.