EUVD-2026-24660
GHSA-g2qw-xxq7-4v3v
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Call To Action Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.3. This is due to missing nonce validation in the cbox_options_page() function which handles saving, creating, and deleting plugin settings. The form rendered on the settings page does not include a wp_nonce_field(), and the save handler does not call wp_verify_nonce() or check_admin_referer() before processing settings updates via $wpdb->update(). This makes it possible for unauthenticated attackers to modify plugin settings such as call-to-action box title, content, link URL, image URL, colors, and other configuration options via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Call To Action Plugin for WordPress versions up to 3.1.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the settings page that allows unauthenticated attackers to modify plugin configuration via forged requests. The vulnerability exists because the cbox_options_page() function lacks nonce validation (missing wp_nonce_field() and wp_verify_nonce() checks), enabling attackers to trick site administrators into clicking malicious links that alter call-to-action box settings including title, content, URL, colors, and other options. No public exploit code has been identified, but the attack requires minimal complexity (AC:L) and relies on user interaction (UI:R) to succeed.
Technical ContextAI
The vulnerability is a classic CSRF attack vector stemming from CWE-352 (missing nonce validation). The Call To Action Plugin uses the cbox_options_page() function to render and process settings updates via WordPress's $wpdb->update() database function. The settings form lacks WordPress's built-in CSRF protection mechanisms: the form template does not call wp_nonce_field() to embed a nonce token, and the settings handler does not call wp_verify_nonce() or check_admin_referer() before processing POST/GET requests containing settings modifications. This allows an attacker to craft a malicious webpage or email link that, when clicked by a logged-in WordPress administrator, silently updates plugin options in the background without the administrator's knowledge or consent. The CPE reference (cpe:2.3:a:tmarek:call_to_action_plugin:*:*:*:*:*:*:*:*) indicates all versions of the plugin are potentially affected.
RemediationAI
Primary remediation is to upgrade Call To Action Plugin to a version newer than 3.1.3 if a patched release is available; check the plugin's WordPress.org page or the Wordfence advisory for the latest safe version. If no patched version exists, disable or deactivate the Call To Action Plugin entirely until a fix is released. For administrators unable to upgrade immediately, implement compensating controls: restrict access to wp-admin settings pages to trusted IP addresses using a Web Application Firewall (WAF) or .htaccess rules, enforce strong password policies and two-factor authentication (2FA) for all administrator accounts to reduce the likelihood of account compromise combined with CSRF, educate administrators never to click unexpected links while logged into WordPress, and review WordPress user roles to ensure only necessary administrators have plugin settings modification capabilities. Note that IP-based restrictions may hinder legitimate remote administration. Monitor the WordPress Security team announcement and Wordfence threat intelligence feed for a patched version release. See https://www.wordfence.com/threat-intel/vulnerabilities/id/6d15f5de-9ec9-466d-aafe-6304356ccb39 for ongoing updates.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today