CVE-2026-4118: WordPress Call To Action CSRF Vulnerability

CVE-2026-4118 Overview

The Call To Action Plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 3.1.3. The vulnerability exists due to missing nonce validation in the cbox_options_page() function, which handles saving, creating, and deleting plugin settings. This security flaw allows unauthenticated attackers to modify plugin configurations through forged requests when a site administrator is tricked into clicking a malicious link.

Critical Impact

Unauthenticated attackers can modify call-to-action box configurations including title, content, link URL, image URL, colors, and other settings via CSRF attacks targeting site administrators.

Affected Products

• Call To Action Plugin for WordPress versions up to and including 3.1.3

Discovery Timeline

• 2026-04-22 - CVE-2026-4118 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-4118

Vulnerability Analysis

This Cross-Site Request Forgery vulnerability stems from a fundamental security oversight in the plugin's settings management implementation. The cbox_options_page() function processes administrative actions—including saving, creating, and deleting plugin configurations—without any CSRF protection mechanisms in place.

The vulnerability is particularly concerning because it targets WordPress administrative functionality. When an authenticated administrator visits a malicious page or clicks a crafted link, their browser will automatically include their WordPress session cookies in the forged request, allowing the attacker's payload to execute with full administrative privileges within the plugin context.

Successful exploitation enables attackers to inject malicious content into call-to-action boxes displayed on the website, potentially redirecting visitors to phishing sites, injecting JavaScript through malicious URLs, or defacing the site's call-to-action elements. This can lead to secondary attacks against site visitors.

Root Cause

The root cause of this vulnerability is the absence of WordPress security functions designed to prevent CSRF attacks. The settings page form rendered by the plugin does not include a wp_nonce_field() call, which would generate a cryptographic token to verify the legitimacy of form submissions. Additionally, the save handler fails to call wp_verify_nonce() or check_admin_referer() before processing settings updates via $wpdb->update().

This represents a violation of WordPress security best practices, which mandate nonce verification for all state-changing administrative operations to ensure requests originate from authorized sources.

Attack Vector

The attack requires social engineering to trick a logged-in WordPress administrator into visiting a malicious webpage or clicking a crafted link. The attacker constructs an HTML page containing a hidden form that targets the plugin's settings endpoint with the attacker's desired configuration values. When the administrator loads this page, the form automatically submits via JavaScript, sending the forged request with the administrator's active WordPress session.

Because the plugin does not validate request origin through nonce tokens, the malicious request is processed as if the administrator intentionally submitted the form. The attacker can modify any plugin setting, including injecting malicious URLs that could redirect site visitors or changing the call-to-action content to display attacker-controlled messaging.

The attack does not require authentication, but does require user interaction from an authenticated administrator, which limits the attack surface while still presenting significant risk to unpatched installations.

Detection Methods for CVE-2026-4118

Indicators of Compromise

• Unexpected changes to call-to-action box settings including title, content, URLs, or styling without authorized administrator actions
• Modified link URLs or image URLs pointing to external or suspicious domains
• Call-to-action elements displaying unfamiliar content or redirecting to unexpected destinations
• Administrator audit logs showing settings changes at unusual times or from unfamiliar referrer URLs

Detection Strategies

• Review WordPress access logs for POST requests to the plugin settings endpoint originating from external referrers or unusual sources
• Implement web application firewalls (WAF) with rules to detect and block CSRF attack patterns targeting WordPress admin endpoints
• Monitor plugin configuration database tables for unauthorized modifications
• Deploy endpoint detection solutions that can identify malicious browser redirects initiated through CSRF attacks

Monitoring Recommendations

• Enable WordPress activity logging plugins to track all settings changes with user attribution and source information
• Configure alerts for call-to-action plugin settings modifications outside of normal business hours
• Periodically audit call-to-action link URLs and image sources to verify they point to legitimate, expected destinations
• Implement SentinelOne Singularity for real-time monitoring of web server processes and detection of anomalous plugin behavior

How to Mitigate CVE-2026-4118

Immediate Actions Required

• Update the Call To Action Plugin to the latest patched version immediately if available
• Temporarily deactivate the plugin until a security update is released if no patch is currently available
• Audit current plugin settings to verify no unauthorized modifications have been made
• Educate administrators about CSRF risks and avoiding clicking links in emails or messages while logged into WordPress

Patch Information

Refer to the Wordfence Vulnerability Report for the latest patch information and update guidance. The vulnerable code can be reviewed in the WordPress Plugin Source Code repository.

Organizations should update to a version higher than 3.1.3 that implements proper nonce validation in the cbox_options_page() function.

Workarounds

• Deploy a Web Application Firewall (WAF) with CSRF protection rules to filter malicious forged requests targeting WordPress admin endpoints
• Restrict access to the WordPress admin area by IP address to limit the attack surface from external networks
• Implement browser-based security extensions that warn administrators before submitting forms to external referrers
• Consider using WordPress security plugins that add additional CSRF protection layers to plugin settings pages

# Configuration example - Add IP restriction to WordPress admin area in .htaccess
<Files wp-admin>
    Order deny,allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>