WP Responsive Popup + Optin <= 1.4 - 'wpo_image_url' 参数的跨站请求伪造导致存储型跨站脚本攻击

The primary impact of CVE-2026-4131 lies in the attacker's ability to modify plugin settings through Cross-Site Request Forgery (CSRF). Specifically, an attacker could alter the 'wpoimageurl' parameter, potentially injecting malicious JavaScript code. This could lead to various consequences, including redirecting users to phishing sites, stealing user credentials, or defacing the website. While the vulnerability requires tricking an administrator into performing an action, the potential for widespread impact across a WordPress site is significant, especially if administrators are frequently targeted with social engineering attacks. The lack of nonce verification makes exploitation relatively straightforward.

活跃安装数

10

插件评分

3.7

需要WordPress版本

3.2+

兼容至

4.1.42

1. 已保留2026-03-13
2. 发布日期2026-04-21
3. 修改日期2026-04-22
4. EPSS 更新日期2026-04-29

The primary mitigation for CVE-2026-4131 is to upgrade the WP Responsive Popup + Optin plugin to a version that includes nonce generation and verification. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block requests to the wpoadminpage.php endpoint without proper authentication. Additionally, educate administrators about the risks of clicking on suspicious links and performing actions without verifying the source. There are no specific Sigma or YARA rules applicable to this vulnerability, as it relies on CSRF and manipulation of plugin settings. After upgrading, confirm the fix by attempting to access the admin page and verifying that nonce fields are present and correctly validated.