The PopAd plugin for WordPress contains a Cross‑Site Request Forgery flaw in versions up to 1.0.4. The flaw arises from missing or incorrect nonce validation on the function that resets cookie time settings. An attacker who can trick a logged‑in site administrator into submitting a crafted request may cause the administrator to reset the cookie time settings without authorization. This changes cookie expiration behavior and can enable easier persistence or session reuse, undermining the intended security posture of the site.

The affected component is the PopAd plugin by alobaidi, deployed on WordPress sites. All installed versions of PopAd version 1.0.4 or earlier are vulnerable. No other WordPress plugins or core software is listed as affected.

The CVSS score of 5.3 categorizes the vulnerability as moderate, and it carries an EPSS score of less than 1%, indicating a very low probability of exploitation at the time of analysis. Because the flaw relies on CSRF via a forged request that merely requires tripping an administrator into clicking a link, the vulnerability is not considered a high‑risk attack vector. Nonetheless, it is not listed in the CISA KEV catalog, which means no publicly available exploit is known but the nature of CSRF suggests that attackers could still pose a threat to sites with insufficient user training or internal controls. Mitigation should focus on ensuring proper nonce validation or disabling the vulnerable functionality before an official patch is applied.