CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_cta_status' and 'change_sticky_sidebar_name' functions in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to update the status of a sticky and update the name displayed in the back-end WP CTA Dashboard.
Explanation of Vulnerability in Simple Terms
WP CTA – Call Now Button allows unauthenticated attackers to modify plugin settings and content without authorization. The vulnerability exists in versions 1.7.0 and earlier due to missing access controls on administrative functions. An attacker can change call-to-action buttons, text, and configuration from the network without needing a WordPress account. Site owners should update immediately to a version newer than 1.7.0.
What an attacker can do
Modify plugin settings and call-to-action button content without a WordPress account.
Potential impact on your site
Attackers can deface call-to-action buttons, redirect calls, or inject malicious content visible to site visitors.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
