Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Call To Action Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.3. This is due to missing nonce validation in the cbox_options_page() function which handles saving, creating, and deleting plugin settings. The form rendered on the settings page does not include a wp_nonce_field(), and the save handler does not call wp_verify_nonce() or check_admin_referer() before processing settings updates via $wpdb->update(). This makes it possible for unauthenticated attackers to modify plugin settings such as call-to-action box title, content, link URL, image URL, colors, and other configuration options via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-4118 The Call To Action Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.3. This is due to missing nonce val… https://www.cve.org/CVERecord?id=CVE-2026-4118
Post summary
The CVE reveals a CSRF flaw in the Call To Action WordPress plugin (v≤3.1.3) caused by missing nonce validation; no PoC, exploit, or patch details are provided.
CVE-2026-4118 Cross-Site Request Forgery in Call To Action Plugin for WordPress Up To 3.1.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4118
Post summary
CVE-2026-4118 exposes a CSRF flaw in the Call To Action Plugin for WordPress (versions ≤3.1.3), with no PoC, exploit code, active exploitation, or patch information provided.