The WP CTA – Call Now Button plugin for WordPress contains a Server‑Side Request Forgery (CWE‑918) flaw that is triggered when an administrator imports a JSON sidebar file containing the 'sticky_s_media' field. The import_sidebars() function blindly passes the supplied URL to file_get_contents() after only basic FILTER_VALIDATE_URL checks, which incorrectly permits internal IP addresses. An authenticated attacker with Administrator or higher privileges can therefore cause the web application to fetch arbitrary internal resources, store the response payload as a media attachment, and effectively obtain a full‑read SSRF that can expose internal secrets or modify data.

All installations of Blend Media’s WP CTA – Call Now Button, Sticky Button & Call to Action Builder plugin up to and including version 2.1.2 are vulnerable. Any WordPress site that has this plugin and allows administrators to import JSON sidebars can be compromised.

The CVSS score of 4.9 indicates moderate severity, while the EPSS score of <1% shows a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because it requires only authenticated administrator access—a common role in many WordPress deployments—the attack surface is relatively high. Exploitation follows a straightforward path: upload a crafted JSON file, trigger the import, and observe the content saved as a media attachment. The CWE‑918 weakness means that proper input validation is lacking, making mitigation through defensive URL checks or internal network blocking a viable strategy.