The discovered flaw stems from a missing capability check in the WP CTA – Call To Action Plugin. Unauthenticated users can call the ’update_cta_status’ and ’change_sticky_sidebar_name’ functions, allowing them to alter the visibility state of sticky buttons and replace the name shown in the WordPress admin dashboard. This weakness, classified as CWE‑862, enables data tampering rather than code execution, but it can be exploited to deface or misleadingly promote content by changing call‑to‑action text and visibility.

The vulnerability affects the Blendmedia WordPress plugin known as WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons. All releases up to and including version 1.7.0 are susceptible; no newer releases were referenced in the advisory.

With a CVSS score of 5.3 this vulnerability falls into the moderate risk range, and its EPSS score of less than 1% indicates a low likelihood of exploitation. The issue is not listed in CISA’s KEV catalog. Likely exploitation involves an unauthenticated attacker sending crafted HTTP requests to the plugin’s endpoints, bypassing WordPress's normal capability checks. No additional authentication is required, meaning any web user with network access to the site can trigger the updates.