The vulnerability identified as CVE-2026-22459 affects the Blend Media WordPress CTA plugin, specifically versions up to 2.1.2. It is caused by missing authorization controls in the easy-sticky-sidebar component, allowing unauthorized access to certain functions or data. The CVSS vector indicates the attack can be performed remotely without privileges or user interaction, with low attack complexity. The impact is limited to integrity and availability, with no confidentiality impact reported. No vendor advisory or patch information is available at this time.

Exploitation of this vulnerability could allow an unauthenticated attacker to perform actions that should require authorization, potentially modifying or disrupting plugin functionality. The impact is limited to integrity and availability, meaning attackers could alter data or cause denial of service conditions within the affected plugin. There is no indication of confidentiality compromise. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from Blend Media and consider restricting access to the affected plugin functionality where possible. No vendor advisory or patch links are currently available.