CVE-2026-4118

Call To Action Plugin <= 3.1.3 - Cross-Site Request Forgery via Settings Update

View on CVE.org
Published Apr 22, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
The Call To Action Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.3. This is due to missing nonce validation in the cbox_options_page() function which handles saving, creating, and deleting plugin settings. The form rendered on the settings page does not include a wp_nonce_field(), and the save handler does not call wp_verify_nonce() or check_admin_referer() before processing settings updates via $wpdb->update(). This makes it possible for unauthenticated attackers to modify plugin settings such as call-to-action box title, content, link URL, image URL, colors, and other configuration options via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

Analysis

AI-generated

Technical impact

The Call To Action Plugin contains a cross‑site request forgery flaw caused by omitted nonce validation in the settings update handler. This defect allows an attacker to send a forged HTTP request that, when executed by an authenticated administrator, will change plugin configuration values such as box title, content, link URL, image URL, and color options. The resulting impact is a compromise of data integrity and potential defacement or phishing of visitors to the site, though it does not provide direct code execution capabilities.

Affected Systems

WordPress sites running the Call To Action Plugin version 3.1.3 or older, the plugin maintained by tmarek, are vulnerable. Any installation of the plugin within this version range is affected.

Risk and Exploitability

The CVSS base score of 4.3 indicates a moderate risk, reflecting that the vulnerability requires administrative interaction for exploitation. The EPSS score is not available and the issue is not listed in CISA KEV. Attackers rely on social engineering to trigger the forged request, typically by convincing a site administrator to click a crafted link. While exploitation potential is limited to users with administrative access, the widespread use of the plugin elevates the overall threat exposure.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Call To Action Plugin to a version newer than 3.1.3 that includes nonce validation in the settings update flow.
  • If a patch cannot be applied immediately, restrict access to the plugin settings page by IP or enforce two‑factor authentication for administrators to reduce the chance of a forged request being accepted.
  • As a temporary workaround, manually verify and revert any unintended changes to the plugin settings and monitor the site for anomalous configuration changes.

Generated by OpenCVE AI on April 22, 2026 at 09:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Tmarek
Tmarek call To Action Plugin
Wordpress
Wordpress wordpress
Vendors & Products Tmarek
Tmarek call To Action Plugin
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description The Call To Action Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.3. This is due to missing nonce validation in the cbox_options_page() function which handles saving, creating, and deleting plugin settings. The form rendered on the settings page does not include a wp_nonce_field(), and the save handler does not call wp_verify_nonce() or check_admin_referer() before processing settings updates via $wpdb->update(). This makes it possible for unauthenticated attackers to modify plugin settings such as call-to-action box title, content, link URL, image URL, colors, and other configuration options via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Title Call To Action Plugin <= 3.1.3 - Cross-Site Request Forgery via Settings Update
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}
Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Apr 22, 2026, 12:58 PM
Reserved
Mar 13, 2026, 1:21 PM

View source JSON

Updated
Apr 22, 2026, 12:58 PM

JSON

Status
Deferred
Published
Apr 22, 2026, 9:16 AM
Modified
Jun 17, 2026, 10:56 AM

View source JSON

No data.

Updated
Apr 22, 2026, 11:44 AM

JSON