What is the CVSS score of EUVD-2026-24660?

EUVD-2026-24660 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Call To Action Plugin EUVD-2026-24660

| CVE-2026-4118 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-22 Wordfence

GHSA-g2qw-xxq7-4v3v

CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:02 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24660

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 4.3

DescriptionCVE.org

The Call To Action Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.3. This is due to missing nonce validation in the cbox_options_page() function which handles saving, creating, and deleting plugin settings. The form rendered on the settings page does not include a wp_nonce_field(), and the save handler does not call wp_verify_nonce() or check_admin_referer() before processing settings updates via $wpdb->update(). This makes it possible for unauthenticated attackers to modify plugin settings such as call-to-action box title, content, link URL, image URL, colors, and other configuration options via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Call To Action Plugin for WordPress versions up to 3.1.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the settings page that allows unauthenticated attackers to modify plugin configuration via forged requests. The vulnerability exists because the cbox_options_page() function lacks nonce validation (missing wp_nonce_field() and wp_verify_nonce() checks), enabling attackers to trick site administrators into clicking malicious links that alter call-to-action box settings including title, content, URL, colors, and other options. No public exploit code has been identified, but the attack requires minimal complexity (AC:L) and relies on user interaction (UI:R) to succeed.

Technical ContextAI

The vulnerability is a classic CSRF attack vector stemming from CWE-352 (missing nonce validation). The Call To Action Plugin uses the cbox_options_page() function to render and process settings updates via WordPress's $wpdb->update() database function. The settings form lacks WordPress's built-in CSRF protection mechanisms: the form template does not call wp_nonce_field() to embed a nonce token, and the settings handler does not call wp_verify_nonce() or check_admin_referer() before processing POST/GET requests containing settings modifications. This allows an attacker to craft a malicious webpage or email link that, when clicked by a logged-in WordPress administrator, silently updates plugin options in the background without the administrator's knowledge or consent. The CPE reference (cpe:2.3:a:tmarek:call_to_action_plugin:*:*:*:*:*:*:*:*) indicates all versions of the plugin are potentially affected.

RemediationAI

Primary remediation is to upgrade Call To Action Plugin to a version newer than 3.1.3 if a patched release is available; check the plugin's WordPress.org page or the Wordfence advisory for the latest safe version. If no patched version exists, disable or deactivate the Call To Action Plugin entirely until a fix is released. For administrators unable to upgrade immediately, implement compensating controls: restrict access to wp-admin settings pages to trusted IP addresses using a Web Application Firewall (WAF) or .htaccess rules, enforce strong password policies and two-factor authentication (2FA) for all administrator accounts to reduce the likelihood of account compromise combined with CSRF, educate administrators never to click unexpected links while logged into WordPress, and review WordPress user roles to ensure only necessary administrators have plugin settings modification capabilities. Note that IP-based restrictions may hinder legitimate remote administration. Monitor the WordPress Security team announcement and Wordfence threat intelligence feed for a patched version release. See https://www.wordfence.com/threat-intel/vulnerabilities/id/6d15f5de-9ec9-466d-aafe-6304356ccb39 for ongoing updates.