The Call To Action Plugin contains a cross‑site request forgery flaw caused by omitted nonce validation in the settings update handler. This defect allows an attacker to send a forged HTTP request that, when executed by an authenticated administrator, will change plugin configuration values such as box title, content, link URL, image URL, and color options. The resulting impact is a compromise of data integrity and potential defacement or phishing of visitors to the site, though it does not provide direct code execution capabilities.

WordPress sites running the Call To Action Plugin version 3.1.3 or older, the plugin maintained by tmarek, are vulnerable. Any installation of the plugin within this version range is affected.

The CVSS base score of 4.3 indicates a moderate risk, reflecting that the vulnerability requires administrative interaction for exploitation. The EPSS score is not available and the issue is not listed in CISA KEV. Attackers rely on social engineering to trigger the forged request, typically by convincing a site administrator to click a crafted link. While exploitation potential is limited to users with administrative access, the widespread use of the plugin elevates the overall threat exposure.