The vulnerability stems from a missing authorization check in the Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin, allowing an attacker with the ability to exploit incorrectly configured access control levels to modify plugin settings arbitrarily. This could be used to alter the appearance or behavior of call‑to‑action elements across the site, potentially misrepresenting content or diminishing user experience. The weakness is classified as CWE‑862, indicating missing or improper access control.

The affected software is the Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin from UX Design Experts. All releases from an unknown initial version through and including version 1.1.1 are impacted; any earlier releases should be treated as vulnerable until confirmed otherwise. Updating to a version beyond 1.1.1 is required to eliminate the missing authorization flaw.

The CVSS score of 6.5 places the bug in the moderate severity range. The EPSS score of less than 1% indicates a very low likelihood of active exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector involves any authenticated WordPress user who can reach the plugin’s settings, from which an attacker could change configuration values if the appropriate role checks are absent.