CVE-2026-1215 is a CSRF vulnerability in the MMA Call Tracking WordPress plugin caused by the absence of nonce validation when saving plugin configuration on the `mma_call_tracking_menu` admin page. This allows unauthenticated attackers to modify plugin settings by convincing an administrator to perform an action such as clicking a malicious link. The vulnerability affects all versions up to and including 2.3.15. The CVSS 3.1 score is 4.3, reflecting a medium severity impact primarily on integrity, with no confidentiality or availability impact.

An attacker can modify call tracking configuration settings without authorization by exploiting the CSRF vulnerability, potentially disrupting or altering call tracking behavior. There is no direct impact on confidentiality or availability reported. The attack requires user interaction from an administrator, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while logged into the WordPress admin interface and consider implementing additional CSRF protections or restricting access to the plugin configuration page.