PT-2026-34286 · WordPress · Call To Action Plugin

Muhammad Afnaan · Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-4118

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Call To Action Plugin versions prior to 3.1.4

Description The plugin is susceptible to Cross-Site Request Forgery due to missing nonce validation in the cbox options page() function, which manages the saving, creation, and deletion of plugin settings. The settings page form lacks a wp nonce field(), and the save handler fails to utilize wp verify nonce() or check admin referer() before processing updates via $wpdb->update(). This allows unauthenticated attackers to modify configuration options, including the call-to-action box title, content, link URL, image URL, and colors, by tricking a site administrator into clicking a forged link.

Recommendations Update to a version newer than 3.1.3.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-4118

Affected Products

Call To Action Plugin

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-4118 · Security Note
• https://twitter.com/VulmonFeeds/status/2046940508878979291 · Twitter Post
• https://plugins.trac.wordpress.org/browser/call-to-action-plugin/trunk/call-to-action-plugin.php#L76 · Note
• https://plugins.trac.wordpress.org/browser/call-to-action-plugin/tags/3.1.3/call-to-action-plugin.php#L55 · Note
• https://plugins.trac.wordpress.org/browser/call-to-action-plugin/trunk/call-to-action-plugin.php#L41 · Note
• https://plugins.trac.wordpress.org/browser/call-to-action-plugin/trunk/call-to-action-plugin.php#L69 · Note
• https://plugins.trac.wordpress.org/browser/call-to-action-plugin/trunk/call-to-action-plugin.php#L55 · Note
• https://plugins.trac.wordpress.org/browser/call-to-action-plugin/tags/3.1.3/call-to-action-plugin.php#L76 · Note
• https://plugins.trac.wordpress.org/browser/call-to-action-plugin/tags/3.1.3/call-to-action-plugin.php#L69 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6d15f5de-9ec9-466d-aafe-6304356ccb39?source=cve · Note
• https://twitter.com/CVEnew/status/2047428124082921570 · Twitter Post
• https://plugins.trac.wordpress.org/browser/call-to-action-plugin/tags/3.1.3/call-to-action-plugin.php#L41 · Note