The MMA Call Tracking plugin for WordPress contains a Cross‑Site Request Forgery flaw that allows an unauthenticated attacker to alter plugin settings due to the missing nonce validation on the mma_call_tracking_menu admin page. By forging a request, an attacker can modify configuration parameters such as tracking numbers or callback settings without the site administrator's knowledge. This can disrupt call handling, alter analytics, or downgrade tracking quality, resulting in loss of accurate data potential business impact.

The vulnerability affects the Messagemetric MMA Call Tracking plugin for WordPress in all releases up to and including version 2.3.15. Any WordPress site using this plugin and not yet updated is potentially exposed to the CSRF attack described above.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in CISA's KEV catalog. Exploitation requires the attacker to convince an administrator to click a malicious link or submit a crafted form that bypasses the nonce check. Because the vulnerability is confined to configuration pages and does not grant arbitrary code execution, the risk is limited to unauthorized changes to call tracking configuration.