Call To Action Plugin
Monthly
Call To Action Plugin for WordPress versions up to 3.1.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the settings page that allows unauthenticated attackers to modify plugin configuration via forged requests. The vulnerability exists because the cbox_options_page() function lacks nonce validation (missing wp_nonce_field() and wp_verify_nonce() checks), enabling attackers to trick site administrators into clicking malicious links that alter call-to-action box settings including title, content, URL, colors, and other options. No public exploit code has been identified, but the attack requires minimal complexity (AC:L) and relies on user interaction (UI:R) to succeed.
Call To Action Plugin for WordPress versions up to 3.1.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the settings page that allows unauthenticated attackers to modify plugin configuration via forged requests. The vulnerability exists because the cbox_options_page() function lacks nonce validation (missing wp_nonce_field() and wp_verify_nonce() checks), enabling attackers to trick site administrators into clicking malicious links that alter call-to-action box settings including title, content, URL, colors, and other options. No public exploit code has been identified, but the attack requires minimal complexity (AC:L) and relies on user interaction (UI:R) to succeed.